Inside Cisco IT: Cisco IT’s Assured Network Access: Identity Services Engine (ISE) Deployment and
Best Practices
Bassem Khalifé: IT Technical Program Manager
Willkommen in Berlin 3
• Deployment Overview
• Requirements & Roadmap
• Strategy & Execution
• Design & Challenges
• Deployment Ecosystem
• Operations Framework
• Business Outcomes
• Lessons Learned
Agenda
Cisco IT ISE Global Deployment
4
ISE PSNs Data Center (8) Network Devices (sites/cities) Auth traffic to ISE PSNs5
6,379 3,583
2,232
2,107
6
Agenda
• Deployment Overview
• Requirements & Roadmap
• Strategy & Execution
• Design & Challenges
• Deployment Ecosystem
• Operations Framework
• Business Outcomes
• Lessons Learned
7
Network ResourcesAccess Policy
TraditionalCisco
TrustSec®
BYOD Access
Threat Containment
Guest Access
Role-Based
Access
Identity Profiling
and Posture
Who
Compliant
What
When
Where
How
A centralized security solution that automates context-aware access to network resources and shares
contextual data
Network
Door
Physical or VM
Context
ISE pxGrid
Controller
8
NetFlow
NGIPS
Lancope StealthWatch
AMP
AMP Threat Grid
FireSIGHT™ Console
CWS
WSA
ESA
FirePOWER™ Services
DURING AFTERBEFORE
ISE
How WhatWhoWhereWhen
9
Requirement Major Technical
Outcome
Major Business
Outcome
Secure Guest Network
ION (Internet Only Network)
Simplified single secure
platform (reduce server footprint
from 28 to 8)
• High availability
• Secure, scalable, and flexible
offering for guests, partners,
and employees
*CVO is Cisco Virtual Office, for small office/home office10
Requirement Major Technical
Outcome
Major Business
Outcome
Secure Guest Network
ION (Internet Only Network)
Simplified single secure
platform (reduce server footprint
from 28 to 8)
• High availability
• Secure, scalable, and flexible
offering for guests, partners,
and employees
802.1x Auth: WLAN, CVO*,
LAN, and VPN
Complete visibility and control of
devices connecting to the
network
• One scalable policy
enforcement environment
• Network segmentation
Requirement Major Technical
Outcome
Major Business
Outcome
Secure Guest Network
ION (Internet Only Network)
Simplified single secure
platform (reduce server footprint
from 28 to 8)
• High availability
• Secure, scalable, and flexible
offering for guests, partners,
and employees
802.1x Auth: WLAN, CVO*,
LAN, and VPN
Complete visibility and control of
devices connecting to the
network
• One scalable policy
enforcement environment
• Network segmentation
Consistent Assured Network
Access
Scalable enterprise secure
network
• Enhanced Risk Management
• Consistent User Experience
• Improved Operations
IT Requirements ISE Capabilities
Access
Control
Authentication
on wired &
wireless
networks as
well as VPNBYOD
Support Trusted
Device
Standard and
enable BYOD
Profiling
Ability to
identify
users and
devices on
our network
Endpoint
Protection
Protect the
network
from
infected
devices
Guest Access
Restrict
unauthorized
devices &
users to
Internet
access only
Device Control
Secure network
while allowing
mobile device
access*
* Cisco IT uses a 3 different Device Management Products
11
Contextual Data
Cross-platform
contextual data
sharing across
the entire IT
infrastructure
• Identity of a device on the network
• Quantify the risk
1. Profiling
• User and end device attribution
• Identification of endpoints on Wireless/Wired connections
2. Authentication• Device security
posture identification
• Allows for better policy & security decisions
3. Posture
• Ability to enforce policy decisions based on context
• Untrusted devices have restricted access
4. Enforcement
The Four Stages of a Secure Network
ISE 1.2 Profiling
ISE 1.2 802.1X Auth
WLAN, CVO
ISE 1.3/1.4 802.1X Auth
CVO, Wired, VPN, MDM
ISE 2.1802.1X Wired Auth Mode
MDM√ √ √
12
ISE Guest ION:
Guest Access
ISE 802.1x Auth:
Wireless, CVO
ISE 802.1x + MAB Monitor Mode:
Wired (Limited)
ISE 802.1x Auth:
VPN + AnyConnect:
• Mobile Devices with Certificate
• Laptops with OTP
ISE/MDM Integration:
Afaria, Casper
ISE SGT:
TrustSec Limited Deployment
ISE/MDM:
Posture Enforcement
ISE 802.1x Auth:
Xtranet/Partners
ISE SGT:
Network Segmentation & Optimization
ISE TACACS+:
Device Administration
ACS + NACs:
Guest Access
ACS Auth: Wireless, CVO
AD Auth + One-Time-Password:
VPN
Open Access:
Wired
Assured Network Access Roadmap
StartACS 5.x
NAC
Active Directory
ISE 1.2
ISE 1.3
ISE 1.4
ISE 2.1
Continue
ISE 802.1x Auth:
Wired (Global)
ISE/MDM Integration:
Afaria, Casper, SCCM
Posture Assessment
Endpoint Protection:
Quarantine/Remediate
√
√
√
√
13
Agenda
“However beautiful the strategy, you should occasionally look at the results.”
Sir Winston Churchill
• Deployment Overview
• Requirements & Roadmap
• Strategy & Execution
• Design & Challenges
• Deployment Ecosystem
• Operations Framework
• Business Outcomes
• Lessons Learned
14
Products
•ISE•AnyConnect• CITEIS
• Cisco Prime Infrastructure
• Webex
• Jabber
• Spark
• Splunk
Practice
•Motivation
•Attitude
•Knowledge
•Experience
•Skills
Process
• Product Life Cycle
• Operational Excellence
• Fast IT, Continuous Delivery
• Change Management
• Agile
People
The “P” Elements
15
• Avoid the “Big Bang”• Too many new capabilities to enable in a single deployment.
• “ISE Deployment Bundle” model• Capabilities have been grouped into bundles to enable targeted & manageable deployments
• Multiple clusters consolidated• Pros and cons of single vs. distributed: ISE Limits, Scalability, # EP, Auth, Latency, AD…
• “Start with one cluster and add more if necessary”
• Global Infrastructure Foundation• Use different Virtual IPs by service (e.g., WLAN, LAN, CVO, VPN) for better manageability and ease/speed of control
• Build a parallel production infra for testing, readiness to scale, and easier upgrade
• Build a cross-functional team from the start• Everybody is an equal partner; extend to the BU
Cisco IT Deployment Strategy
16
Cross Functional Ownership for ExecutionSVP
Operations
CIO
SVP IT
VP IT
Mobility
Any Device
SVP
Infra Services
Sr. Dir
Network Services
VP
Ops/Impl
Dir
Strategy & Security
Security Services
Directory Services
Sr. Dir
Data Centers
Sr. Dir
Arch/Design
SVP
Security & Trust
VP
InfoSec
Security
Requirements
and Policy
Owns Mobile
Devices,
Responsible for
Posture
Enforcement
Provides DC
and Virtual
Infrastructure
Owns and
Manages the
Deployment of
NW Services
Owns and
Operates the
NW
Infrastructure
Team, owns the
infra for
Network and
Application
security
services
Owns Active
Directory Infra
and Services
High Level
Architecture
and Design
Operational
Excellence:
99.999%
Availability
17
AlignmentSecurity BU
Engineering
Development
Product
Development
Engineering Test
Sample ISE Basic Deployment Roadmap (6 quarters)CY14 Q3 CY14 Q4 CY15 Q1 CY15 Q2 CY15 Q3 CY15 Q4
Fine tune Optimize
Foundation ISE 1.2
Install
ISE 1.3
Upgrade
ISE 1.4
Upgrade
Infra
Design, Proof of Concepts, Data Analysis
Apply
patches
Fine tune Optimize
Network
Guest
Wireless
Monitor
Endpoint Analysis: Wired dot1x MM & Profiling
VPN
Wired
802.1x Authentication
Guest Access
Wireless (WLAN) Auth Deployment
CVO (Home Office) Wireless Auth
VPN Auth
CVO Wired Auth
Limited Sites Wired Auth
Global Wired Auth Deployment
Quarantine/Remediation Posture Assessment & Enforcement (MDM)
Security Group Tagging (SGT)Advanced Capabilities
ISE 2.0
Upgrade
Fine tune
18
Deployment Readiness
Design Engineer Personal Lab
Solution Verification Lab
Stage & Pilot
Deploy!
19
• Production Infrastructure• Network Access ISE 1.4, P6 24 VM servers in one global deployment
• Guest Services ISE 1.2, P13 8 VM servers in one dedicated deployment
• Services In Production• Guest services (ION) (400+ sites, potential 130K+ users & 14K guests per week)
• Internet Only Network access requires pre-registration via ISE guest portal for all users; CWA (central web auth)
• 802.1X Wireless Auth Mode (400+ wlan sites, 90K+ users, ~150K endpoints)
• 802.1X Auth CVO (wireless/wired) (27K Network Devices for home access; ~60K endpoints)
• 802.1X Wired Monitor Mode* (3.5K LAN Switches and Gateways, ~200K endpoints)
• 802.1X VPN Access (AnyConnect) (70 ASAs; ~110K users; 150K+ endpoints)
• 802.1X Wireless Partners/Xtranet (3 sites; ~1K Users/Endpoints)
• SGT/TrustSec (wireless/wired) (3 sites; ~6K Users/Endpoints)
• To-date: 1M+ Profiled Endpoints; Max of 75K+ Concurrent Endpoints
Cisco IT ISE Production Deployment Metrics
20
21
How many?
Agenda
• Deployment Overview
• Requirements & Roadmap
• Strategy & Execution
• Design & Challenges
• Deployment Ecosystem
• Operations Framework
• Business Outcomes
• Lessons Learned
22
Original Design for Multiple ISE Deployments
Guest Global
Services
TYO
BGL
AER
RTPALNMTV
HKG
SNG
Secondary ISE PAN/M&T
ISE PSN
Primary ISE PAN/M&T
Primary Secondary Admin Nodes
MTV AER
All-in-one23
Single Global ISE Deployment (WLAN, CVO, LAN, VPN)
AER
RTP
ALN
MTV
SNG
Secondary ISE PAN/M&T
ISE PSN
Primary ISE PAN/M&T
24 ISE Nodes
20 PSNs; 8 DC (Node Groups)
TYO
HKG
BGL
24
Users/Endpoints by Node Group
25
18,362
9,961
23,969 26,070
32,651
28,124
12,870
5,317
32,856
14,765
40,995
37,481
58,846
51,878
21,384
9,445
-
10,000
20,000
30,000
40,000
50,000
60,000
70,000
AER ALLN BGL HKG MTV RTP SNG TYO
Users
Endpoints/MAC
Avg. 33K Endpoints
Guestnet Original Deployment
MTV
Sponsor
Portal
(GSS)
internet.cisco.com
Guest Account
Creation
Wireless access
Wired access
NADs AMER
Guest Portal Auth
VMS
Tool
Lobby
Ambassadors
Guest Account
Creation
Wireless access
Wired access
NADs EMEA/APJC
Guest Portal Auth
AER
Before MTV AER
All-in-onePrimary
SecondarySingle Point of FailureAll services will be affected, and
likely to also impact the
secondary node.
26
Guestnet (ION) Redesigned DeploymentGeo Proximity Based NAD & GSS Configuration
MTV
Sponsor Portal GSSinternet.cisco.com
Guest Account Creation
Wireless access
Wired access
NADs AMER
Guest Portal Auth
Pri
mary
ion-mtv-guest
ion-mtv-sponsor
Wireless access
Wired access
NADs EMEA/APJC
Guest Portal Auth
AER
PPAN Alias
PAN
PAN MnT
MnT
PSN PSN PSN PSN
Primary
MTV
Secondary
AER
ion-aer-guest
ion-aer-sponsor
Pri
mary
ION LB
VIPs
VMS
Tool
Lobby Ambassadors
Guest Account Creation
Integration With Reception
Secondary
Secondary
ION LB
VIPs
27
• All users must authenticate to the guest network for Legal and Security reasons.
• Cisco employees acting as sponsors are responsible and accountable for the actions of their guests.
• Cisco guests and employees must accept the policy and liability disclaimer to receive Internet access.
• Cisco employees do not need to create a guest account, they use their corporate credentials.
• Guest User Accounts can have a maximum lifetime of seven days.
• Cisco guests will not be able to print on Cisco's printer network.
• Only one active Guest User Account is permitted per user. Users or guest cannot have multiple active accounts or sessions.
• Technical support for personal computing devices is the responsibility of the guest or Cisco employee. Technical support will not be provided for personal devices under any circumstances.
Guest Network (ION) Policies
28
• Scaling ISE for large scale distributed deployments
• Don’t let replication or misconfiguration become an issue for authentication:
• Tuning the “deployment” (ISE, NADs, and Endpoints)• RADIUS Accounting
• Profiling
• Authentication(s)
• Latency & Distributed Replication
• Failover & Redundancy
• Tuning the “environment”• Load Balancers
• Active Directory
Cisco IT Early Deployment Challenges
29
Iceberg (īs’bûrg’)
(Former state)
ISE Burj
(Current state)
Replication
Issues
Profiling
Error notification
Load Balancer misbehavior
NAD misbehavior
Endpoint misbehavior
Latency
Radius
accounting
SNMP errorsMisconfiguration
Replication Challenges
30
Octo
ber
September November
Tune the Deployment and the Environment
Configuration
Changes:
NAD and ACE
(LB)
Accounting
Suppression
Fix:
CSCur42723
Removing IP
as Significant
Attribute Fix:
CSCur44879
31
ISE Global Deployment Profiling Setting
1
ISE Global Deployment Profiling Setting
PSN Configuration
1
ISE Global Deployment Profiling Setting
PSN Configuration
1
ISE Global Deployment Profiling Setting
PSN ConfigurationEvery 24 hours (86400 seconds), any and all PSNs start
SNMP polling 27K CVO devices, whether they are
connected or not, in the same region - latency friendly -
or not, causing 600K errors, affecting replication.
1
Network Device Configuration
ISE Global Deployment Profiling Setting
PSN ConfigurationEvery 24 hours (86400 seconds), any and all PSNs start
SNMP polling 27K CVO devices, whether they are
connected or not, in the same region - latency friendly -
or not, causing 600K errors, affecting replication.
1
Network Device Configuration
CSCur95329
Simple fix; Great
value!
ISE Global Deployment Profiling Setting
PSN ConfigurationEvery 24 hours (86400 seconds), any and all PSNs start
SNMP polling 27K CVO devices, whether they are
connected or not, in the same region - latency friendly -
or not, causing 600K errors, affecting replication.
1
Network Device Configuration27K CVO Network Devices configured under 29 subnets
in ISE. SNMP polling is disabled using the new option
“zero” as the devices were not always connected,
resulting in timeout errors (600K), affecting replication.
CSCur95329
Simple fix; Great
value!
Explicitly choose
the polling PSN
Large Deployments – Bandwidth and Latency
PSN PSN
PAN MnT MnTPAN
PSN PSN
PSN
PSN PSN
PSN
PSN PSN
PSN PSN
PSN PSN
PSN PSN
PSN PSN
PSN PSN
200ms
Max round-trip
(RT) latency
between any two
nodes in ISE
1.2/1.3
• Bandwidth most critical between:
• PSNs and Primary PAN (DB Replication)
• PSNs and MnT (Audit Logging)
• Latency most critical between PSNs and Primary PAN.
• RADIUS generally requires much less bandwidth and is more
tolerant of higher latencies – Actual requirements based on
many factors including # endpoints, auth rate and protocols
WLC Switch
RADIUS
40
Latency Resolution Options
AER
169msALN RTP
TYO
134ms
SNG
186ms
HKG
154ms
MTV
BGL
219ms
45ms
AER
169msALN RTP
TYO
134ms
SNG
186ms
HKG
154ms
MTV
BGL
219m
sX
Option 1
Option 2
+ 45ms
- 45ms
41
Agenda
• Deployment Overview
• Requirements & Roadmap
• Strategy & Execution
• Design & Challenges
• Deployment Ecosystem
• Operations Framework
• Business Outcomes
• Lessons Learned
42
ISE Deployment Ecosystem: Building Blocks
ISE (Logical Layer)
ISE (Physical Layer) : ISE Appliance OR VM (Fabric, Compute, Storage)
Network: DNS, NTP, SFTP, UDP, TCP, (& Load Balancers)
Network Access
Devices
Endpoints: Devices,
Users & Supplicants
Enterprise Monitoring: HTTP(S), RADIUS, PEAP, EAP-FAST, EAP-TLS
User
Provisioning
Mobile Device
Management
Network
Device
Provisioning
ISE Policy
Management
Active
Directory
Call Manager100’s K
10’s K
1 PAN
Data
Analysis
(Syslog)
43
Quality
MAP
Monitor
ActPrevent
To Trust or ... Risk vs. Access
• Create device access policies based on risk/assurance criteria, your level of control, and risk tolerance:
• Company managed devices
• Vendor/Partner managed devices
• BYOD (OS dependent: iOS, Android, Windows Mobile, Linux, Samsung, etc.)
• Printers, Cameras, Badge Readers, etc.
• IoE/IoT devices
e.g.
IoE/IoT
devices
e.g. Company
managed
devices
LOW HIGH
H
I
G
H
L
O
W
ACCESS
AS
SU
RA
NC
E
L
O
W
H
I
G
H
RIS
K
BYOD
Vendor/Partner
managed devices?
44
UnderstandingWhat Is ConnectingTo TheNetwork
45
‘Misbehaving’ SupplicantsEndPoint Profile Auths Per Day
Count of EndPoints
% of Total EndPoints
Avg Auths Per Endpoint
Windows7-Workstation 98,394 25,918 20.99 3.8
Apple-iPhone 745,807 17,820 14.43 41.85
Microsoft-Workstation 69,216 16,469 13.34 4.2
Apple-Device 67,167 8,720 7.06 7.7
Workstation 49,834 8,408 6.81 5.93
Android 115,839 5,160 4.18 22.45
OS_X_Mavericks-Workstation 17,529 4,644 3.76 3.77
OS_X_Yosemite-Workstation 17,718 4,276 3.46 4.14
Apple-iDevice 97,862 3,813 3.09 25.67
Android-Samsung-Galaxy-Phone 78,539 3,146 2.55 24.96
Android-Samsung 39,250 3,132 2.54 12.53
Apple-MacBook 14,014 2,883 2.34 4.86
Android-Motorola 70,695 2,226 1.8 31.76
Android-Google 44,835 1,761 1.43 25.46
Wireless auth over 24 hours. 46
ISE Authentication Storm/Meltdown From a “Simple” Change
Data
Analysis
(Syslog)
Call Manager
IP Phones
accidentally
enabled for
802.1x auth
Luckily only ~4M auth requests per day due
to limited deployment of a dozen switches. Target scope is 100K IP Phones = 250M Auth
Detection &
troubleshooting
ISE (Logical Layer)
Network Access
Devices
Endpoints: Devices,
Users & Supplicants
1,600 IP Phones
started MAB/dot1x
auth frenzy: 2,600
attempts per day,
per phone= ~4M
47
Agenda
• Deployment Overview
• Requirements & Roadmap
• Strategy & Execution
• Design & Challenges
• Deployment Ecosystem
• Operations Framework
• Business Outcomes
• Lessons Learned
48
• Trained support team with broad knowledge of environment, across multi time zones
• Troubleshooting using both ISE and Big Data
• Enterprise monitors, load balancer & NAD probes
• Reporting and alerting, covering the ecosystem:• Number of Devices, Endpoints, Auth, failed/passed, by region, device type…
• Profiled devices by group, analysis and validation of profiling results (if used in policy)
• Measure progress of deployment based on pre-migration data
• Splunk ISE app, dashboards providing detailed usage
• Infra utilization, and alerting on CPU, Disk, Memory
• Correlate events with the rest of the network components and tools
Operations Maintenance & Monitoring
49
Resources for Operations + Resources for Deployment
2 Sr. Engineers + 2 Support Engineers (multi-zone)
• Performance monitoring and tuning, scalability for growth
• HW/SW issues
• Troubleshooting, field issues
• Provisioning of Network Devices, and Users support
• Monitoring and Reporting (ISE reports and Splunk)
• Patch/Upgrade
• Infra/VM issues, Change Request support
• Policy Management
2 Sr. Engineers, 1 Analyst, 1 PM• Learning and Testing new capabilities
• Solution Verification Lab testing and certification support
• Automation of new operational activities
• Limited Availability validation of new features
• Product and platform bug identification and validation
• Data analysis and scalability for new capabilities
• Acquiring knowledge of new capabilities & cross functional environment support
• Documentation
50
Splunk Cisco ISE App
51
Testing High Availability When 1 DC Fails (AER => RTP)
52
Consolidated Dashboards
53
Load Distribution Deep Dive
54
Traced Back to Load Balancer
Configuration (Stickiness by Source IP)
Splunk Custom Dashboards For Troubleshooting
55
• Document it as you build it
• Leverage the tools that you have; build the ones that you need
• Automate monitoring & alerting; cover all building blocks
• Thoroughly test every change; create baselines
Quality MAP:
• Monitor & Measure; Assess & Act; Predict & Prevent
The Framework
56
Agenda
• Deployment Overview
• Requirements & Roadmap
• Strategy & Execution
• Design & Challenges
• Deployment Ecosystem
• Operations Framework
• Business Outcomes
• Lessons Learned
58
Forrester 2011
“Cisco TrustSec and Cisco ISE are consistent with our view of identity-centric end-to-end security that is
both needed and lacking in the enterprise today.”
59
Business Driver
InitiativeTo divest Assets including employees and
properties to Technicolor
ObjectiveTo create logical separation on network
infrastructure and provide secure resource
access in shared workspace
SolutionTo utilize TrustSec Security Group Tagging
solution based on user ID for authentication
and authorization
Dynamic User Policy (DUP)
60
SHN4/7/15 Campus Overview
61
Lawrenceville Campus Overview
62
SHN7/LWR01-06 DUP Solution Summary
Desktop Switch Desktop GatewayBB/SBB
Gateway
WAN
GatewayWLC WLC Gateway
SHN7
12th Floor
HW
ModelC4510-SUP8E C6K-SUP2T C4500X N/A WiSM2 C6K-SUP2T
CTS /
DUP
• 802.1X Authenticator
• Wired SGT Classifier
• SXP Speaker
• PreAuth/Permit-Any
ACL
• Wired SGT Enforcer
• SXP Listener
• Downloadable SGACL
• 802.1X Authenticator
• Wireless SGT Classifier
• SXP Speaker
• Wireless SGT
Enforcer
• SXP Listener
• Downloadable
SGACL
LWR01-06
HW
ModelC6K-SUP32 C6K-SUP2T C4500X N/A WiSM2 C6K-SUP2T
CTS /
DUP
• 802.1X Authenticator
• Wired SGT Classifier
• SXP Speaker
• PreAuth/Permit-Any
ACL
• Wired SGT Enforcer
• SXP Listener
• Downloadable SGACL
• 802.1X Authenticator
• Wireless SGT Classifier
• SXP Speaker
• Wireless SGT
Enforcer
• SXP Listener
• Downloadable
SGACL
63
DUP High Level Scope Overview
SXPSGACL
SGACL
SGACL
SXPSXP
SXP
64
Preconfigured
PreAuth ACL on
interfaces
Configure TrustSec, 802.1X, ACLs on desktop switch/gateway, WLC and WLC gatewayA
Configure SXP Speaker and Listener on “desktop switch/gateway” peer, and “WLC/WLC gateway” peer B
Configure ISE with Tags, SGACLsC
DUP Wired User Classify/Enforce Flow
* Cisco
* Technicolor
* Unauthenticated
SXP
cts role-base permissions (on Desktop gateway)
Destination SGT
Source SGT Cisco Internal Technicolor PreAuth (DT SW)
Cisco Permit Permit Permit
Technicolor Deny Permit Permit
Unauthenticated Deny Deny Permit
Untrusted Deny Deny Permit
MAB/
SXP
SXP
65
Permit
Any
Pre-
Auth
Pre-Configuration
Enforcement Flow
Preconfigure PreAuth and “permit any”
ACLs on Desktop switch and SGACLs on
ISE
A
User connects to Desktop switch, 802.1X
sends user credential info to ISE 1
A
C
B
ISE forwards assigned SGT to the Desktop
switch based on user’s AD and policy2
B SXP Tunnels Established
C SGACL Downloaded from ISE Periodically
2
1
3
Desktop switch replaces PreAuth ACL with
“permit any” if a Cisco or Technicolor user
authenticated. Otherwise, PreAuth ACL
remains.
Desktop Gateway enforces traffic
According to user SGT and SGACL.
3
3
3
1
“Magic Quadrant for Network Access Control”, Gartner, Dec 2014
67
IAM/SSO
EMM/MDM
Security Information and Event Management (SIEM)
Packet Capture
Operational/Industrial Network Security
(IoT)Vulnerability Management
Risk Modeling
Custom Detection
And
Forensics
& IR
Rapid Threat Containment
(RTC)
Firewall
Access Control
68
Context Aware Security Spectrum
Who?
When?
Where?
How?
What?
Employee Customer/Partner Guest
Personal Device Company
Asset
Wired Wireless VPN
@ Starbucks Headquarters
Weekends (8:00am – 5:00pm) PST
Context-Aware Security Opportunity
69
Context-Aware Security Use Cases
ACCESS POLICY – “Sensitive Data”
WHO = Exec Group Only
WHAT = Registered Corp device only
WHERE = US Only
WHEN = US Business Hours Only
HOW = Corporate Network
or VPN Access
Access Criteria
Sensitive
Non-Sensitive
Critical Data
1. Sensitive Data Access Policies 2. Portable Assurance Level for Cloud Apps
Financial Reports
Café Menus
HR Database
70
Context-Aware Security : Bridging The Gap…
Network
SecurityCisco
ISE
Device Context
WHAT
User Context
WHO
Other Context
HOW, WHERE, WHEN
Network Context
WHO, WHAT, HOW, WHERE,
WHEN
ConnectorIdentity Over IP
(ID/IP)
Context-
Aware App
Security
Network + App
Security Context
WHO, WHAT, HOW, WHERE, WHEN
Network
Limited Context
AFARIA CASPER
SCCMMDMs
2
ISE pxGrid
71
1 3
4
Application
Security
Network
Rich Context
Better Security(Layered Sec, Elevated Auth)
Better User Experience(Zero Sign-On Experience)
Flexible & Granular
Access Policies
5
6
Agenda
• Deployment Overview
• Requirements & Roadmap
• Strategy & Execution
• Design & Challenges
• Deployment Ecosystem
• Operations Framework
• Business Outcomes
• Lessons Learned
72
• Acquire ISE expertise upfront; invest in design
• Fine tune deployment and environment, they must work in tandem
• People, Process, Practice, and Products will derive success – or not
• Build the foundation and grow with the product and its ecosystem
• Follow BU guidelines; will cover 80% of the known challenges
• Listen to the data, and the alerts/alarms
• Do not take the network for granted
• Trust is utopic…Think risk
• Plan for the unexpected!
Lessons Learned
73
We are here. We are ready!
References
• Cisco.com/go/ise; Cisco.com/go/anyconnect; Cisco.com/go/trustsec
• Annual Security Report 2016
• ISE Design Guides
• Bringing Context-aware Security to Applications
• Securing the Internet of Everything with ISE
• Securing Cloud Applications
• Ping and ID Over IP Leveraging PxGrid
• Forrester: “The Total Economic ImpactTM Of Cisco TrustSec” [March 2015]
74
Call to Action I
• Recommended Related Sessions:
• Monday:• Advanced - Network Access Control with ISE (Identity Service Engine) 2.0 [TECSEC-3672]
• Tuesday:• Lunch and Learn - Cisco Identity Services Engine (ISE) [LALSEC-0003] (12:45)
• Innovation Talk, Protect and Grow Your Business with Cisco Security (14:15)
• Advanced - Designing ISE for Scale & High Availability [BRKSEC-3699]
• Inside Cisco IT: IOE/IOT, User Devices and Security -- Cisco's Internal Strategy [COCSEC-2003]
• Wednesday• Using Cisco pxGrid for Security Platform Integration [DevNet-1124]
• What's new in ISE Active Directory Connector [BRKSEC-2132]
• Deploying ISE in a Dynamic Public Environment [BRKSEC-2059]
• Thursday• Advanced ISE Services, Tips and Tricks [BRKSEC-3697]
• Inside Cisco IT: Evolving Application Security on the Cloud [COCCLD-2016]
• Customer Appreciation Event
Call to Action II
• Visit the World of Solutions for
• Cisco Campus – Security Demos (ISE 2.0, AnyConnect, VPN, MERAKI, AMP, etc.)
• Walk in Labs –
• Technical Solution Clinics
• Meet the Engineer/PM
• I am available until Thursday
• Lunch and Learn Topics
• Lunch and Learn - Cisco Identity Services Engine (ISE) [LALSEC-0003]
• DevNet zone related sessions
• Using Cisco pxGrid for Security Platform Integration [DevNet-1124]
Complete Your Online Session Evaluation
• Please complete your online sessionevaluations after each session.Complete 4 session evaluations& the Overall Conference Evaluation(available from Thursday)to receive your Cisco Live T-shirt.
• All surveys can be completed viathe Cisco Live Mobile App or theCommunication Stations
• Booth Number: C3 (just to the left of the Cisco Campus in Hall 4.2)
• Speak with our subject matter experts, sharing their real-world experience using and deploying Cisco technologies in our own environment.
The Cisco on Cisco Booth
Live Demos…
• Internet of Things: In the Workplace
• Network Infrastructure Security
• Application Centric Infrastructure (ACI)
• Collaboration & Video
Agenda
• Deployment Overview
• Requirements & Roadmap
• Strategy & Execution
• Design & Challenges
• Deployment Ecosystem
• Operations Framework
• Business Outcomes
• Lessons Learned
79
Thank you
85
We are here. We are ready!
Top Related