Transcript 전자상거래 요소기술
INTEGRATED SECURITY MANAGEMENT KNOM-2000 2000. 12. 12 Tai M. Chung Real-Time Systems Lab. Sungkyunkwan University [email protected] RTSL Real-Time Systems Laboratory Talk Outline Introduction to ISM and Research Objectives Current Integrated Security Management Technologies OPSEC Active Security Common Data Security Architecture Integrated Security Management System Architecture of ISMS Features of ISMS Architecture & Detailed Modules of ISMS Current Status and Future Development of ISMS RTSL Real-Time Systems Laboratory Why ISM? Increasing complexity & difficulty of security products Diverse security policies for heterogeneous security systems scattered over wide network Increasing risks resulting from human mistakes Need for immediate and automated response to various security threats Need for unified human interface for simple management File Security VPN Vulnerability Test Virus IDS Check Intrusion Tracking Firewall Authentication Encryption RTSL Real-Time Systems Laboratory Research Objectives Develop a common representation scheme for diverse security policies with Integrated policy and data management scheme Easy and unified interface for total management Prototype a master-agent based integrated security management system that Includes Coordinated management model based on common representation scheme Immediate and autonomous response to security threats Fault tolerant capability for continuous service Flexible and scalable management architecture RTSL Real-Time Systems Laboratory Security System Integration Trends of ISM OPSEC Active Security RTSL Real-Time Systems Laboratory Hybrid Integration Model Integrate IDS functionality with firewall CISCO IOS + Firewall IDS Firewall includes IDS functionality for mid-range, high-performance platforms, Limited to detect most significant attacks only Acts as in-line intrusion detection sensor : watching packets and sessions to detect intrusion as well as to apply firewall policy Paging Mail to admin Internal network RTSL Real-Time Systems Laboratory Attack signatures match found intrusion detected block the connection IDS module Firewall module Auditing rules Access policies Internet Interoperational Model Real-time intrusion blocking : IDS interoperable with firewall RealSecure(ISS) + Firewall-1(Checkpoint) When IDS detects misuse or attacks; ① ② ③ ④ Reconfiguring firewall to block all traffic from a suspicious source Alerting appropriate personnel through user interface Sending an SNMP trap to NMS to record the session information Terminating connections if possible Internal network Mail server Mail to admin IDS Internal firewall SNMP trap NMS RTSL Real-Time Systems Laboratory DMZ network Paging Policy configuration message External firewall Internet Server pool (for public/customer service) OPSEC by Checkpoint Open Platform for Security / Open Platform for Secure Enterprise Connection Based on SVN(Secure Virtual Network) environment Goes beyond VPNs for securing all internet gateways Fine-grain access control for all users Provisioning of integration and interoperability to the various security products such as VPN-1, Firewall-1, FloodGate-1, and Meta IP Openview, Tivoli, etc. RTSL Real-Time Systems Laboratory OPSEC framework Check Point Management Console with Account Management CA Directory Server Content Security Server URL Categorization Server Policy Verification Reporting and Analysis Intranet Internet Enterprise Management Platform OpenView, Tivoli, etc. VPN-1/Firewall-1 Gateway Intrusion Detection Meta IP Address Management with User-to-Address Mapping RTSL Real-Time Systems Laboratory VPN-1/Firewall-1 Gateway VPN-1 SecuRemote/ VPN-1 SecuClient Remote office OPSEC API overview Message based, layered environment OPSEC Transport Layer converts messages into events Client locates and initiates the connection to the Server Servers implements one or more OPSEC security tasks OPSEC Client Process OPSEC Server Process OPSEC client OPSEC server OPSEC service API OPSEC service API OPSEC transport API OPSEC transport API OPSEC Transport TCP RTSL Real-Time Systems Laboratory The OPSEC Client and Server Process can also be the same process Memory Other mechanism The OPSEC Transport Layer links the OPSEC Client and Server using one of these mechanisms Life Cycle of OPSEC Application Endless loop(opsec_mainloop) Waits for event to occur and process them Events are handled by the OPSEC application OPSEC layer may call user-defined functions to process events Program startup Initialization Handle for Event #1 Event #1 main loop Event #2 Asynchronous Events RTSL Real-Time Systems Laboratory Handle for Event #2 OPSEC Environments A framework for OPSEC applications to communicate One OPSEC environment for each OPSEC process OPSEC entity is an instantiation of a specific behavior Machine Machine Process Process Machine Process OPSEC environment OPSEC entity LEA client OPSEC entity SAM client RTSL Real-Time Systems Laboratory OPSEC environment OPSEC environment OPSEC entity LEA server OPSEC session OPSEC session OPSEC entity LEA server Process OPSEC session OPSEC environment OPSEC entity SAM server OPSEC subcomponents CVP (Content Vectoring Protocol) Content security UFP (URL Filtering Protocol) Web resource management SAMP (Suspicious Activity Monitoring Protocol) IDS interoperability LEA (Log Export API) Reporting and event analysis ELA (Export Logging API) Security and event consolidation OMI (OPSEC Management Interface) Management and analysis UAM (User to Address Mapping API) Association between user and IP address SAA (Secure Authentication API) Integrated authentication RTSL Real-Time Systems Laboratory Content Security : CVP Outsourcing some functionalities to other content security systems Forward buffer to CVP server for inspection Viruses, malicious codes Flow out of confidential data Specific URL access CVP client and server know nothing about each other, except that the client knows where to find the server Firewall-1/VPN-1 CVP client Buffer Source Events Server flow CVP server RTSL Real-Time Systems Laboratory Event handler (callback) functions Destination flow API functions Destination Content Security : CVP Applied CVP to detect and cure compromised mail by viruses Firewall rule base specifies virus checking and disinfection on mail attachment Firewall CVP client contacts the Anti-Virus server and transfers the file attachment for processing The Anti-Virus content validation server scans for viruses, disinfects the file The Anti-Virus sever returns the virus-free file and log information to the firewall Mail Server 3rd Party Anti-Virus Application Server Scan and cure Internet Mail Internet RTSL Real-Time Systems Laboratory Web Resource Management : UFP Track and monitor web usage Categorize and control HTTP communication based on specific URL address Operations URL client on the firewall passes the URL to the UFP server URL server returns a classification of the category for the URL Firewall determines the appropriate action in accordance with the security policy related to the category RTSL Real-Time Systems Laboratory Intrusion Detection : SAMP Intrusion detection by monitoring events Active feedback loop integration between IDS and Firewall/VPN gateways SAMP API enables Firewall-1/VPN-1 to block the connection when an IDS detects suspicious activity on the network or specific host SAMP API defines an interface through which an IDS can communicate with a VPN-1/Firewall-1 management server Management server directs the VPN-1/Firewall-1 modules to terminate sessions or deny access to those specific hosts. RTSL Real-Time Systems Laboratory Event Integration : LEA, ELA LEA(Log Export API) Enables applications to read the VPN-1/Firewall-1 log database LEA client can retrieve both real-time and historical log data from Management Console of LEA server A reporting application can use the LEA client to progress the logged events generated by the VPN-1/Firewall-1 security policy ELA(Event Logging API) Used to write to the VPN-1/Firewall-1 log database Enables third party applications to trigger the VPN-1/Firewall-1 alert mechanism for specific events Enables Management Console to become the central event repository for all traffic events accounting and analysis With SAMP, applications can track suspicious activity and request the VPN-1/Firewall-1 to terminate a malicious activity RTSL Real-Time Systems Laboratory Management and Analysis : OMI Interface to central policy database to share objects such as Host, Network, User, Service, Resource, Sever, Key.. Tie together different products that may control security policies in different domains Enables third party applications to securely access the policy stored in the management server by providing access to read Policies stored in the management sever Network objects, services, resources, users, templates, groups and servers defined in the management server List of all administrators that are allowed to log into the management server RTSL Real-Time Systems Laboratory Authentication : SAA SAA(secure authentication API) Supports wide variety of authentication mechanisms such as biometric devices, challenge response tokens and passwords Passing authentication information to the authentication server After authentication, VPN gateway acquires user's certificate from CA server, and then IPSEC/IKE session is established Customers Internet VPN-1 Gateway RTSL Real-Time Systems Laboratory Partners Remote site VPN-1 SecuRemote OPSEC Framework Partners Content Security Safe gate, Computer Associates Norton AntiVirus for Firewalls, Symantec Authentication and Authorization Defend Security Server, Axent Technologies, Inc. ACE/Server, RSA Security Intrusion Detection RealSecure, Check Point Technologies, Ltd. SessionWall-3, Platinum RTSL Real-Time Systems Laboratory Event Analysis and Reporting Firewall HealthCHECK, VeriSign Web Trends for Firewalls and VPNs, Web Trends Enterprise Directory Servers IBM SecureWay Directory, IBM Novell Directory Services, Novell Enterprise Directory Servers Go! Secure, VeriSign Overview of Active security Detection(Sensing) device E.g. : Vulnerability Scanner to proactively scanning internal network Event Orchestra Accepts all alerts, compares with security policy and initiates responses Fed in Security Policy to decide what is important and how to respond Actions for security through Helpdesk, Firewall, Administrator Alerts, etc. Security Policy Helpdesk Firewall Vulnerability Scanner RTSL Real-Time Systems Laboratory Event Orchestra Administrator Alerts More about Active Security The heart of Active Security : Event orchestra Conducts central event management Standard based open event management system Centrally collects alerts and other inter-process communications from security products Includes own data store, but also works with other database using ODBC Current Active Security products sensor : CyberCop scanner (Windows NT) arbiter : Event orchestra (Windows NT) actor : Gauntlet firewall (Windows NT / UNIX) RTSL Real-Time Systems Laboratory sensors arbiters actors watch the network for trouble decide what to do when trouble happens take responsive action Example of Active security : CyberCop WMI(Windows management instrumentation) Describes a standard way of accessing and representing management information in Windows 2000 networks Enables real-time monitoring Enhances interoperability of security applications Provider Existing Logs Event log Object manager Performance monitor Forthcoming File/print Anti-virus events RTSL Real-Time Systems Laboratory IDS events SQL server Firewall events Consumer Others Others Event Orchestra Windows 2000 WMI CyberCop Monitor Action module Active Security Illustration A Actor agent Firewall 1. Incoming mail message S Sensor agent 2. Redirect mail to anti-virus server A Network Virus Protection Gateway 4. action : do not accept mail from [email protected] S 3. Virus found in message From : [email protected] To : [email protected] 5. action :Scan all files owned by 'joe' Event Orchestra 7. Unallowed 'finger' service found on Host1 Vulnerability Scanner RTSL Real-Time Systems Laboratory Network File Server S A 8. action :Shutdown 'finger' service on Host1 6. Scan hosts for compliance to network security policy Host1 A What is CDSA? The Open, cross-platform, interoperable, extensible and exportable security infrastructure Specification and Reference Implementation Adopted by The Open Group in November 1997 “Mature” code base from Intel, widely reviewed by Industry A robust security building block for eBusiness software solutions Enables interoperability for security apps and services Allows developers to focus on application expertise RTSL Real-Time Systems Laboratory CDSA Design Goals Create an open, interoperable, cross platform security infrastructure Support use and management of the fundamental elements of security: Certificates, trust, cryptography, integrity Authentication, authorization Make extensible above and below Embrace emerging technologies Plug-and-play service provider model Extend to new services Layered service provider model RTSL Real-Time Systems Laboratory CDSA Architecture CDSA defines a four-layer architecture for crossplatform, high-level security services CSSM defines a common API / SPI for security services & an integrity foundation Service providers implement selectable security services Applications Layered Security Services CSSM Security API Common Security Services Manager Service Provider Interfaces Security Service Add-in Modules Security Service Add-in Modules Security Service Add-in Modules RTSL Real-Time Systems Laboratory Structure of ISMS security management Web client ISMS Engine SNMP Agent SNMP Agent Network A RTSL Real-Time Systems Laboratory Central policy database SNMP Agent policy policy Firewall DBMS IDS Network B policy VPN Network C Features of ISMS Integrated policy management Maintain logical security domain for consistent security management Applies access control policy automatically by deploying blacklist to agents Automated response to threats Automatic Policy integrity check at management server Removes potential risks resulting from human mistakes by autonomous operation and by integrity checking Notification through unified user interface Integrated view for security management through web interface Statistic information based on collected information Fault tolerant security management Records all security related events through central logging Simple policy recovery and backup through central policy management Scalability and flexibility using master-agent paradigm No modification to management engine RTSL Real-Time Systems Laboratory Detailed ISMS architecture Notification UIM Policy UIM Configuration UIM Secure TCP Log management module Notification message processing module Configuration file Message Communication module Session management module Message analyzing module DBMS interface State monitoring module RTSL Real-Time Systems Laboratory Security management Client Security management DBMS DBMS proxy User authentication module DBMS SMDB Policy processing module Management message communication module Secure UDP Notification processing module Log UIM Message communication module Secure UDP Configuration management module Status UIM Display module Notification processing module Log file Monitoring UIM Central security management server Secure UDP Configuration management module Management message communication module Message analyzing module Configuration file Security system control module Security product Log management module Log file Security management agent Detailed ISMS Engine ISMS ISMS engine Manages policies Processes user requests Notifies events Collects information from agents Manages log data RTSL Real-Time Systems Laboratory Downloaded Java Applet ISMS server WISMS engine Agent log file Engine log file TCP/IP HTTP Communication module Data processing modules User request processing modules User table Request mapping table DBMS Manager (ISMS client) Log manager Client(Java applet) Engine(Solaris) Agent(Solaris, LINUX, FreeBSD) Using standard management protocol(SNMP) Extensibility, Scaleability SNMP communication module Policy table Agent table ISMS MIB SNMP Firewall agent Firewall agent IDS agent Agent for other security products HTTPD HTML Pages Java Applet Web serve r Integrated policy management Security policy for IDS Security policy for firewall Backup/Restore SMDB (primary) Security policy for VPN DBMS proxy Synchronizing DB Security management policy DBMS SMDB (secondary) proxy Policy Security management agent for IDS IDS Security management client Central security management server Policy distribution/recover Policy Security management agent for Firewall Firewall Policy Security management agent for VPN VPN Policy update/action command RTSL Real-Time Systems Laboratory Automated Response to threats Response policy for specific event (Automatic response) SMDB Log DBMS proxy Record events Policy Central security management server Notification Security management policy RTSL Result reply Security management agent for IDS Security management agent for firewall / VPN IDS Firewall / VPN Detect suspicious action Real-Time Systems Laboratory Policy update/action command Policy Notification for human operation Security Manager Security management policy SMDB Log DBMS proxy Record events Policy Security management client Central security management server Notification Response policy for specific event (Notify manager/wait for command) Security management agent for IDS IDS Detect suspicious action RTSL Real-Time Systems Laboratory Policy update/action command Result reply Security management agent for firewall / VPN Firewall / VPN Policy Logical secure domain maintenance User information Domain user information Security management client User registration SMDB DBMS proxy Central security management server Log User information Secure domain RTSL Real-Time Systems Laboratory Security management agent for firewall Security management agent for VPN Access control (Firewall) Secure communication (VPN) Application with authentication capability Blacklist management Security management client Blacklist Manual backlist update Central security management server DBMS proxy SMDB Automatic blacklist update Log Blacklist information or Policy update Suspicious subject information Security management agent for firewall Security management agent for VPN Security management agent for IDS Firewall VPN IDS Log RTSL Real-Time Systems Laboratory Log Log ISMS Deployment Structure Web based security management web client Access Control External Firewall User's request Control message ISMS Engine request /result Policy update Internal Firewall 1 Internal Network 2 Internet Internal Firewall 2 Virus Scanner IDS Internal Network 1 RTSL Real-Time Systems Laboratory Internal Network 3 Summary Increasing need for Integrated security management Easy and unified user interface Integrated Policy management Currently Integrated Security Management is a hot issue Checkpoint(OPSEC), Network Associate(Active Security), and Intel(CDSA) develop standards and prototypes They are still under development CDSA is publically available We have been working for Designing a integrated model to manage various security products Develop a prototype system with one view and total security concept RTSL Real-Time Systems Laboratory References and Further Information [1] Open Platform for Security(OPSEC) Technical Note, Check Point Software Technologies, Inc., 2000. [2] OPSEC Software Development Kit Data Sheet, Check Point Software Technologies, Inc., 1998. [3] Check Point OPSEC SDK version4.1 Release Notes, Check Point Software Technologies, Inc., November 1999. [4] Check Point VPN-1/Firewall-1 OPSEC API Specification version4.1, Check Point Software Technologies, Inc., November 1999. [5] Check Point Firewall-1 OPSEC Open Specification version1.01, Check Point Software Technologies, Inc., November, 1998. [6] Active Security Getting Started Guide version5.0, Network Associates, Inc., 1999 [7] Automating Security Management while Reducing Total Cost of Ownership, Network Associates, Inc., 1999 [8] Security Solutions Practice - Technology Update, Ernst & Young, LLP., March 1999. [9] Ensuring the Success of E-Business Sites, NetScreen Technologies, Inc., January 2000. [10] Technology Overview: The NetScreen-1000 Gigabit Security System, NetScreen Technologies, Inc., March 2000. [11] Next Generation Security Solutions for the Broadband Internet, NetScreen Technologies, Inc., February 2000. [12] ServerIron Data Sheet; Internet Traffic Management, Foundry Networks, 2000. [13] Application note; Firewall Load Balancing with ServerIron, Foundry Networks, 2000. RTSL Real-Time Systems Laboratory