Intro técnica a Imperva

I Sesi贸n de Introducci贸n t茅cnica

Conceptos bรกsicos clave

Attack Protection

Usage Audit

Virtual Patching

Rights Management

Reputation Controls

Access Control

Objetivo: Proteger datos de negocio Thick Client 2 Tier App

DBA

MS Office Knowledge workers

Thin Client 3 Tier App

Data

Apps

SQL

File Access

Browser Application Interface

Portals

Línea de Productos v8.0  Common platform

 Management  Analytics  Reporting  Alerting  Multiple deployment options

 Physical Appliances  Virtual Appliances  Agents

Propuesta: Web Security •

•

•

Protegernos de peticiones maliciosas: – Desvíos del uso normal de la aplicación y sus datos – Intentos de explotar vulnerabilidades, conocidas o no – Originadas desde orígenes maliciosos – Parte de un sofisticado ataque complejo Virtually patching de las vulnerabilidades de nuestras aplicaciones, a través de la CVSS CVSS integración del WAF con nuestros scanners de vulnerabilidades (Common Vulnerabilities (Common VulnerabilitiesScoring ScoringSystem) System) – Reduciendo la ventana de exposición y el posible impacto – Cumpliendo + ID CVE los requisitos PCI = Más 6.6 Información!!

• IBM + IDAppScan, NIST HP WebInspect, NTObjetives, Cenzic, WhiteHat

Actualizando nuestras defensas Web con el conocimiento de los actuales threats

Propuesta: Database Security •

Auditar todos los accesos a datos sensibles por parte de usuarios y aplicaciones privilegiadas – Como requieren PCI 10, SOX, HIPPA y otras regulaciones • Alerta y bloqueo de ataques a las databases y de peticiones anormales, en tiempo real • Detección y virtual patching de las vulnerabilidades de nuestros motores de bases de datos • Indentificación de permisos excesivos & ‘dormant users’ sobre datos sensibles – Agregar permisos de usuarios DB a través de todas las DBs de la red – Reducir al máximo el acceso a datos sensibles según necesidades de negocio (PCI 7) • Acelerar la respuesta ante incidentes y capacitar de analíticas avanzadas para investigación forense

Propuesta: File Security •

Auditar todo el acceso a ficheros sensibles por parte de usuarios y aplicaciones privilegiadas – PCI 10, PCI 11.5 (monitorización de integridad de archivos) • Alertar o bloquear las peticiones de acceso a ficheros que violen las políticas corporativas • Identificar excesivos permisos a ficheros con datos sensibles y habilitar un completo ciclo de aprobación de permisos – Agregar permisos de usuarios DB a través de todas las DBs de la red – Reducir al máximo el acceso a datos sensibles según necesidades de negoc (PCI 7) • Acelerar la respuesta ante incidentes y la investigación forense a través de analítica avanzada

Opciones de Deployment DAM / DBF •

Transparent Inline Bridge – Supports full enforcement

SecureSphere

Data Center

– High performance, low latency – Fail-open interfaces

•

Non-inline Deployment – Primarily for monitoring, zero network latency

•

Switch SecureSphere

Light host-based agents

– Local mode: Local Privileged Activity – Global mode: Complete Visibility

Sniffing mode deployment LightInline host-based deployment agents

Opciones de Deployment WAF •

Inline – Acts as a firewall device on the network – Serves as a device processing traffic on its way to the data center – Usually used when desired that the Gateway will block malicious or unauthorized network access to the data center

•

Sniffing – Acts as a sniffing device on the network – Gateway analyzes the sniffed traffic and performs a monitoring function

•

Reverse Proxy – Acts as a routing device on the network – Terminates the traffic on the NIC and sends the packet off for inspection.

Transparent Inline Bridge Deployment • • • •

Supports full enforcement High performance, low latency Fail-open interfaces Used in DBF, FFW, WAF, & DSS

Data Center

Switch

SecureSphere

• Inline Bridge Deployment

Sniffing (Non-Inline) Deployment • Primarily for monitoring • Zero network latency • Used in DAM, FAM, & DSS

Data Center SecureSphere

Switch

• Non-inline Deployment

Reverse Proxy Deployment •

Multiple modes

•

High performance for content modification

•

URL rewriting, cookie signing, SSL termination

•

Used in WAF only

Data Center SecureSphere

Switch

SecureSphere

• Reverse Proxy Deployment

Modos de trabajo de DB Agents

• Local Mode

Direct Access

Network Access

• Global Mode

Direct Access

Network Access

Appliance Based Solution  Appliance-based solution  Runs on a protected Linux 2.6 OS  Appliance model chosen based on:

 Product License  Inspected Throughput: Connections and TPS  Network Design and Connectors  Hardware and virtual appliance options

SecureSphere Appliances

•

7 Models, 2 HW Platforms – 2 Management (MX) models – 5 Gateway models – Supported software versions: 6.2, 7.0, 7.5, 8.0

15

Models

X1000

Throughput Interfaces

Max Network Segments Hard Drive Memory Form Factor Supported SecureSphere Products

Fault Tolerance

X-Series Gateway X2000

X2500

X4500

X6500

100 Mbps

500 Mbps

500 Mbps

1 Gbps

2 Gbps

6 x 1GbE

6 x 1GbE

Copper

Copper

6 x 1 Gbps (max 4 Fiber interfaces)

6 x 1 Gbps (optional 10Gbps Fiber; optional 4 additional Copper)

10 x 1 Gbps (optional 10Gbps Fiber)

2 Bridge, 5 Proxy, Non-inline

2 Bridge, 5 Proxy, Non-inline

(2) Bridge; (5) Proxy, Non-inline

(4) Bridge; (9) Proxy, Non-inline

(4) Bridge; (9) Proxy, Non-inline

500 GB

500 GB

2 hot-swap 500 GB

2 hot-swap 1 T

2 hot-swap 1 T

2 GB

4 GB

4 GB

8 GB

8 GB

1U

1U

2U

2U

2U

Web Application Firewall Discovery and Assessment Server

Web Application Firewall Discovery and Assessment Server Database Activity Monitoring Database Firewall File Firewall Dual, hot-swap HD, PS and fans

Dual, hot-swap HD, PS and fans

Dual, hot-swap HD, PS and fans

16

X-Series MX MX Models

M100

M150

N/A

Dual, hot-swap hard drives, power supplies, and fans

2 x 1GbE

2 x 1GbE

Copper

Copper

300 GB 10K

2 hot-swap 300 GB 10K

Memory

4 GB

4 GB

Add-on Options

N/A

LOM or Fiber Channel

Form Factor

1U

2U

Fault Tolerance

Interfaces

Hard Drive

Safety Agency Approval Number of Supported Gateways

CE/FCC/cTUVus/VCCI up to 15

17

Field Replaceable Units – FRU • 3 FRU hot-swappable components – HDs – Fans – Power Supplies

• 1 FRU Not hot-swappable component – Network interface modules

• 2U fault tolerant appliances only

18

Add-on Options • • • •

LOM - Lights Out Management HSM –Hardware Security Module (Ncipher) SSL Accelerator (default for X6500) SAN Storage Area Network – HBA Host Bus Adapters

• Thumb Rules – LOM OR HBA OR HSM – HSM and SSL acceleration cards are redundant in their operation and only one can be installed at a time.

• Available for X2500, X4500 and X6500 models only

19

Port Numbering 0 1

0 1 0 1 2 3 4 5

0 1

2 3 4 5

20

6 7 8 9

• Referred to by initialization script • Used during interface configuration

Virtual Appliances • Software solution • Benefits – – – – –

V1000

Cost Savings Energy Efficient Hardware Consolidation VMotion support Inter-VM protection

V2500

V4500

VM150

SecureSphere on VMware ESX Server • Fully functional SecureSphere Virtual Appliance • Support for VMware ESX and ESXi 3.5 or higher • Gateway deployment options – Inline transparent bridge – Sniffing – Reverse proxy

• Support mixed environments (physical/virtual) under one MX • Fail-Open (or bypass) and SSL Acceleration is not supported

Items Lista de Precios – Tabla de Items Imperva.xlsx

Arquitectura l贸gica Imperva

Base de arquitectura de MenĂşs

Concepto de correlaci贸n Application Level Service Level Server Group Level

WAF + ThreatRadar WAF

WAF + ThreatRadar