Soluciones de Seguridad, para un planeta más inteligente

Presentación del tema: "Soluciones de Seguridad, para un planeta más inteligente"— Transcripción de la presentación:

1 Soluciones de Seguridad, para un planeta más inteligente http://www
Soluciones de Seguridad, para un planeta más inteligente Juan Paulo Cabezas Security Architect for Spanish South America

2 Nuevos Riesgos. Instrumentado Interconectado Inteligente
Soluciones de Seguridad , para un planeta más Inteligente ¿Hacia donde va la seguridad en un planeta más inteligente? Smart water management Smart energy grids Smart healthcare Smart food systems Intelligent oil field technologies Smart regions Smart weather Smart cities Smart traffic systems Smart retail Smart countries Smart supply chains Nuestro mundo esta cada vez más Instrumentado Nuestro mundo esta más Interconectado Nuestro mundo es cada vez más Inteligente 4 areas principales Amenaza Interna, de varias formas: comportamiento involuntario, falta de entendimiento de políticas, falta de educación, ingeniería social Necesidad de cumplir regulaciones Móviles Seguridad asociada a la innovación, Cloud/social networking/nuevos negocios This new magnitude of data and the new services using the data, raises privacy and safety concerns. Greater efficiency relies on better data, and often very sensitive data. Greater control relies on physical assets installed well outside of the data center or at consumer’s locations. This opens new avenues for criminals, new kinds of denial of service attacks. Nuevas posibilidades. Nuevas complejidades. Nuevos Riesgos. 2

3 Características de 25 “eventos”
Soluciones de Seguridad , para un planeta más Inteligente Características de 25 “eventos”

4 Características del nuevo escenario y cambio de paradigma
Soluciones de Seguridad , para un planeta más Inteligente Características del nuevo escenario y cambio de paradigma En el informe de X-Force del 2010 se indica: “.. En vez de enfocarse en un único punto de entrada, las nuevas amenazas tienen como objetivo múltiples recursos en la compañía. No sólo lo expuesto al público esta en riesgo, sino que, cada empleado y endpoint se ha convertido en un potencial punto de entrada”. El “adversario” externo es altamente entrenado e inteligente, por lo que se requiere una postura más activa ante el riesgo. Un memo de la Casa Blanca en el 2010 sobre FISMA (Federal Information Security Management Act) indica: “Las agencias deben ser capaces de monitorear continuamente la información de seguridad a través de la organización, de una manera gestionable y procesable” Alan Paller, Director de investigación del instituto SANS, indicó ante el Congreso: “.. Las Agencias deben dejar de gastar dinero en reportes anticuados, en vez deben enfocar su gasto en el monitoreo continuo y reducción del riesgo”

5 IBM Security Solutions Portafolio
Soluciones de Seguridad , para un planeta más Inteligente IBM Security Solutions Portafolio (Note to presenter: The purpose of this slide is to highlight that IBM offers the breadth and depth – unlike any other vendor -- with our security portfolio. The intent is not to engage in a technical discussion at this point or try to cover all areas in detail (Note to presenter: If there is interest in a certain domain (i.e., people and identity, application and process, etc.), use the drill down slides that provide the next level of information on our offerings – including how we can help with our software, professional and managed services In presentation mode, you can click on the icons displayed on the top left hand side of the focus area boxes to quickly navigate to the appropriate drill down slide.) Keep in mind that customers often usually jump in at the wrong point so they may not have completely addressed all security risks. At times they buy something they don’t understand (aka shelfware)… they implement a security solution but forget the need to monitor it ongoing or to invest in training and awareness for a more security aware culture. What this means to you is that even if a customer already has a solution in place… it’s not the end of the story. They may still need services to optimize, or managed services to monitor – for example.) IBM has a unique position in the market as an end-to-end security provider – we can address virtually any dimension of a secure infrastructure – and provide the services and consulting to help customers develop a strategic approach to their security challenges. Across our portfolio, we provide many capabilities that help customers solve a wide range of security problems completely and in the process result in cutting costs, reducing complexity, and assuring compliance. The IBM Security Framework provides Customers with Implementation Choices Professional services IBM helps clients address expertise gaps through consulting services that leverage our industry and security expertise Managed services IBM helps clients address skills and staffing gaps through our managed security services, including SaaS and Cloud based services Hardware and software IBM helps clients address security challenges through direct licensing of hardware and software products 5

6 Advanced correlation and deep
Soluciones de Seguridad , para un planeta más Inteligente Un modelo de seguridad enfocado en madurez People Data Applications Infrastructure Optimized Role based analytics Identity governance Privileged user controls Data flow analytics Data governance Secure application development Fraud detection Advanced network monitoring / forensics Secure systems Proficient Identity management Strong authentication Activity monitoring Data loss prevention Application firewall Source code scanning Asset management Endpoint / network security Basic Passwords and user identities Encryption Access control Vulnerability Perimeter security Anti - virus Governance, risk and compliance Advanced correlation and deep Combine together the concept of the Security Phases and the Dimensions of Security and you see that IBM has a detailed vision to help customers climb the curve towards a more Optimized security stature. 6 6

7 TOP 20 Controles Críticos de Seguridad, según SANS Institute
Soluciones de Seguridad , para un planeta más Inteligente TOP 20 Controles Críticos de Seguridad, según SANS Institute Inventory of Authorized and Unauthorized Devices: Tivoli Endpoint Mgr Inventory of Authorized and Unauthorized Software: Tivoli Endpoint Mgr Secure Configurations for Hardware and Software on Laptops, Workstations, and Servers: Tivoli Endpoint Mgr y IBM Security Server Protection Secure Configurations for Network Devices such as Firewalls, Routers, and Switches: Tivoli Netcool Configuration Manager Boundary Defense: IBM Security Network IPS Maintenance, Monitoring, and Analysis of Security Audit Logs: Tivoli Security Information & Event Mgr Application Software Security: IBM Security Network IPS + Rational Appscan Controlled Use of Administrative Privileges: Tivoli Identity Mgr+Tivoli Access Mgr ESSO = Privileged Identity Manager Controlled Access Based on the Need to Know: IBM Security Server Protection y Tivoli Endpoint Mgr Continuous Vulnerability Assessment and Remediation: Tivoli Endpoint Mgr y IBM Security Network IPS Account Monitoring and Control: Tivoli Identity Mgr+Tivoli Security Information & Event Mgr Malware Defenses: Tivoli Endpoint Mgr for Core Protection, IBM Security Network IPS y IBM Security Server Protection Limitation and Control of Network Ports, Protocols, and Services: Tivoli Endpoint Mgr, IBM Security Network IPS, IBM Security Virtual Server Protection, IBM Security Server Protection Wireless Device Control Data Loss Prevention: IBM Security Network IPS, IBM Security Virtual Server Protection, IBM Security Server Protection

8 Protección de Amenazas en profundidad
Soluciones de Seguridad , para un planeta más Inteligente Protección de Amenazas en profundidad Reconnaissance Attack Infiltration Entrenchment Prevención Detección de Eventos de Seguridad Detección de Anomalías Prevención Reconocimiento Infiltración Ataque Cubrirse Security Event Detection technology has matured and is widely deployed. We have see that it is not enough and that monitoring solutions on the endpoint are required. Anomaly detection on the endpoint is still maturing. Methods to detect suspicious, unauthorized changes and activity on the endpoints are required to identify (1) successful infiltration from the outside (2) insiders circumventing controls (3) privilege escalation (from internal or external threat agents) Solución de Aseguramiento de Seguridad Parchado, Control de Acceso, etc. NIDS, HIDS, AV, Net Flow Prevención de fuga de información, Listas Blancas de Aplicaciones

9 Tivoli Endpoint Manager
Soluciones de Seguridad , para un planeta más Inteligente Tivoli Endpoint Manager permite a los clientes consolidar sus operaciones de TI y funciones de seguridad en una sola vista Ayuda a proveer Visibilidad total Control de calidad Rapidez en remediación Gran escalabilidad Framework versátil Reducción de costos Mediante Gestión de configuración de seguridad y vulnerabilidades Gestión del ciclo de vida de los sistemas Protección contra Malware y firewall a través de tecnologías Trend Micro™ Conocimiento de ambientes virtuales Gestión de consumo energético Tivoli Endpoint Manager for Patch Management Lifecycle Management Security and Compliance Power Management Core Protection Transcript: At Pulse it's been talked about many times that the system management world and security world is coming together. I think we've seen that on the horizon, but I think we're now to the point we see it in reality as well, that secure is going to equal managed. It's not that we can put the products in place, but we've got to add them to our active operational management for them to work. A great case in point has been with our BigFix acquisition. We've now rebranded that as Tivoli Endpoint Management, that we have the capability now to identify all of the endpoints out there, do active automation and patching around those. And with that platform in place, we can drive significant functionality out across the board. We're in the midst of rolling BigFix out at IBM. The first thing that surprised us as we started running the app was how many endpoints IBM actually has. You know, we've got 400,000 employees. We found out we have over 800,000 endpoints now to manage. As we started bringing together the system management aspect of BigFix with our antivirus, typically our antivirus efficiency is at about 65%. When we started marrying the two together so that we had auto detection on the endpoints that we saw with automated patching in place, we got up into the high 90s. We also found that doing this automation allowed us to have much better ratings in our remote geographies where we don't have the training, we don't have the dedicated staff. It's been a tremendous saver for us with hard facts around it. Author's Original Notes: Comentarios de clientes: “Se reemplazó el antivirus existente en 4300 estaciones de trabajo en 2 semanas, sin problemas” “Se pasó de un 60% al 95%+ de A/V actualizados a la última firma” “No se necesitó hardware adicional para su funcionamiento”

10 Course Title (Change on Notes Master)
Soluciones de Seguridad , para un planeta más Inteligente Tivoli Endpoint Manager apoyando la gestión de vulnerabilidades y configuración de seguridad Detección y Gestión de vulnerabilidades basadas en: OVAL Open Vulnerability and Assessment Language CVE Common Vulnerabilities and Exposures CVSS Common Vulnerability Scoring System Mejores prácticas y plantillas basadas en: Defense Information Systems Agency, Security Technical Implementation Guide para Unix y Windows Federal Desktop Core Configuration Win XP/Vista Win 2003 United States Government Configuration Baseline Windows 7 Through a repository of vulnerability assessment policies, Tivoli Endpoint Manager can assess managed computers against Open Vulnerability and Assessment Language (OVAL) vulnerability definitions. OVAL is a collection of XML schema for representing system information, expressing specific machine states, and reporting the results of an assessment. © Copyright IBM Corp Course materials may not be reproduced in whole or in part without the prior written permission of IBM.

11 Nuevo IBM Security Network IPS GX7800
Soluciones de Seguridad , para un planeta más Inteligente Nuevo IBM Security Network IPS GX7800 Funcionalidades Claves Equilibrio entre seguridad y rendimiento de las aplicaciones críticas de negocio Enfocado a gestionar amenazas cambiantes en un ambiente con pocos recursos y baja especialización Reducir el costo y la complejidad de la infraestructura de seguridad Capacidades de protección a nivel de red de Core Capacidades básicas Protección más allá de los IPS de red tradicionales: Protección de aplicaciones Web Protección de ataques a nivel cliente Funcionalidades de Data Loss Prevention (DLP) Control Aplicativo Tecnología de Virtual Patch Rendimiento Incomparable provee capacidad de inspección de trafico de mayor a 20Gbps de throughput, con conectividad 10GbE sin comprometer la profundidad y amplitud de protección Evolución de la protección impulsado por la investigación de X-Force para estar “delante de la amenaza“ IBM Security Network Intrusion Prevention GX7800 Ubicación Remoto Perímetro Core Modelo GX4004-V2 -200 GX4004-V2 GX5008-V2 GX5108-V2 GX5208-V2 GX6116 GX7800 Tráfico Inspeccionado 200 Mbps 800 Mbps 1.5 Gbps 2.5 Gbps 4 Gbps 8 Gbps 20 Gbps+ Segmentos 2 4 8 11

12 Soluciones de Seguridad , para un planeta más Inteligente
IBM Virtual Server Protection for VMware Protección de amenazas Integrales para VMware vSphere 4 Ofrece la más amplia, integrada y profunda protección para ambientes virtualizados con un solo producto Firewall Integración con VMsafe Detección de Rootkit Intrusion Detection & Prevention Análisis de tráfico entre VMs Gestión separada de VMs Aplicación de política de red Protección integrada con VMotion Auto descubrimiento de VMs Auditoría de Infraestructura Virtual (Monitoreo de usuarios privilegiados) Protección de segmentos virtuales Virtual Network-Level Protection Virtual NAC Gestión Centralizada Protección de Web Application Virtual Patch I am proud to announce our newest offering to make virtualization easier, IBM Virtual Server Security. Our product offering will begin shipping later this year quickly followed by professional services and managed services offered to both direct clients as well as service providers in 2010. We are launching an integrated solution in a virtual appliance form factor – it is integrated with the new VMsafe initiative within the new vSphere 4 release from VMware and gives us the ability to have a hypervisor level view into security. We are providing the same Intrusion Prevention System and protocol analysis engine we are using in the rest of our IPS products. We are in line between all of the VMs not only capturing information in between, all without requiring any changes to the virtual network itself. This offers true plug and play connection which is the automated protection expertise. The product also provides firewall technologies for critical network level access control specifically designed to prevent virtual server sprawl. In conjunction with X-Force research we detect VMsafe APIs (based on a blacklist approach) to get signatures or finger prints of known rootkits to alert users to any malware in the system without any presence in the guest operating system. Our virtual infrastructure auditing ties into regulatory compliance initiatives to make sure there is a holistic view of the infrastructure to report on privilege user activities. We can report on virtual network changes, new VMs created, suspended and moved from one layer to another. As we originally promised to the industry, we are the first to market to incorporate our intrusion prevention technology and X-Force capabilities into true virtual infrastructure protection – providing our clients the flexibility to use both physical network, host or virtual devices all centrally managed through SiteProtector. 12

13 Gobierno de Identidades, Tivoli Identity & Access Assurance
Soluciones de Seguridad , para un planeta más Inteligente Gobierno de Identidades, Tivoli Identity & Access Assurance IBM líder tecnológico y del mercado. Gestión segura, automatizada y basada en políticas de las cuentas y permisos de usuarios. Soluciones de Single Sign-On para ambientes Web, Federaciones y estaciones de trabajo. Integración con sistemas de autenticación robusta Monitoreo automatizado de actividad de usuarios Auditoria de Usuarios Gestión Identidades Gestión Accesos 13

14 Gobierno IAM basado en Políticas
Soluciones de Seguridad , para un planeta más Inteligente La estrategia de IBM para gestión de identidades y accesos provee las bases para establecer gobierno de la Identidad Aplicaciones Titularidad Roles de Aplicaciones Gobierno IAM basado en Políticas Personas Roles de Negocios Usuarios Datos Datos no Estructurados Datos Estructurados Monitoreo de actividad de usuarios y conformidad con políticas y regulaciones Monitoreo Visibilidad de identidades de usuarios, sus roles y derechos a aplicaciones y a datos Control de definición de roles y asignación de usuarios a roles y derechos – gobernanza y cumplimiento Automatización de suministro de usuario, rectificación de acceso y distribución de políticas 14 14

15 IBM Tivoli Identity Manager
Soluciones de Seguridad , para un planeta más Inteligente IBM Tivoli Identity Manager Request for Access Generated Policy & Role User Change Automatización Users with Accounts Administrators Create Accounts Approval Routing IT InBox 15 15

16 Tivoli Access Manager for Enterprise Single Sign-On
Soluciones de Seguridad , para un planeta más Inteligente Tivoli Access Manager for Enterprise Single Sign-On TAM E-SSO provee: Enterprise SSO Autenticación de Doble Factor Workflows Automatizados para Seguridad y Acceso Estaciones de trabajo compartidas Auditoria y seguimiento de uso de aplicaciones por usuario Gestión centralizada Sin ningún cambio en la organización TAM E-SSO offers the support variety and flexibility that is needed in an Enterprise SSO tool, to securely facilitate logon, password change, and logoff to all Enterprise applications. First, we support fingerprint biometrics from Upek and Digital Persona as well as smart cards in USB token form factor. Second, it allows the user to connect from a different set of client devices, including web server, remote desktops, desktops, terminal workstations, and pervasive devices. The user wallet, which contains all the credentials for the user, is managed and distributed by the central IMS server. This wallet can be used in a direct connection to the IMS server, or in disconnected mode. The TAM E-SSO agent that sits on the client workstation retrieves the user wallet and uses it to automatically log the user to each application requested. TAM E-SSO uses profiles on the client to identify how to interact with each particular application. There is support for hundreds of application profiles out of the box. Besides facilitating the SSO function, TAM E-SSO also ensures that all activity is tracked for auditing and compliance purposes. TAM E-SSO provee visibilidad de la actividad de los usuarios, control sobre los accesos a los recursos, y automatizaciónen el proceso de SSO para entregar un valor significativo hacia nuestros clientes. 16

17 ¿Por que IBM ? Opinión de los analistas
Soluciones de Seguridad , para un planeta más Inteligente ¿Por que IBM ? Opinión de los analistas Liderazgo en Gartner Magic Quadrant User Provisioning (Nov 2010) Web Access Management (November 2008) Static Application Security Testing (Dic 2010) Enterprise Governance, Risk and Compliance Platforms (Oct 2010) Security Information and Event Management (May 2009) Gartner en Marketscope Enterprise Single Sign-On - Strong Positive (Sept 2010) Web Access Management - Positive (Nov 2010) Network Intrusion Prevention System Appliances Magic Quadrant IDC Market Share Leadership #1 Identity & Access Management (2009) #1 Identity Management Provider (2007) #1 Security & Vulnerability Management Software Worldwide (2007) #1 Vulnerability Assessment Software Worldwide (2007) #1 Application Vulnerability Assessment Software Worldwide (2007) Liderazgo en Forrester Wave Database Auditing and Real-Time Protection (May 2011) Managed Security Services Wave (Ago 2010) Information Security And Risk Consulting Services (Ago 2010) SC Magazine Identity Access & Assurance, Best Identity Management Application 2011 IBM, Best Security Company, 2010 ENTERPRISE MANAGEMENT ASSOCIATES Leadership in Intrusion Prevention (Ene 2010)

18 Soluciones de Seguridad , para un planeta más Inteligente
¿ Consultas ? 18

19 Por Un Mundo Más Inteligente La Gente Lo Quiere Nosotros Lo Hacemos