Automated Security Control with ForeScout CounterACT
•
4 j'aime•3,499 vues
Network Access Control is used to control access to enterprise networks. Mobile Device Management is used to manage and secure mobile devices. Put them together and your customers can set network access policies based on knowledge of the device - the Power of Two! Forescout is global leader in NAC. MobileIron is global leader in MDM/MCM/MAM and Secure Mobile IT.
Recommandé
Recommandé
Contenu connexe
Tendances
Tendances (20)
Similaire à Automated Security Control with ForeScout CounterACT
Similaire à Automated Security Control with ForeScout CounterACT (20)
Plus de Andris Soroka
Plus de Andris Soroka (20)
Dernier
Dernier (20)
Automated Security Control with ForeScout CounterACT
- 1. © 2012 ForeScout Technologies, Page 1 Ed Buffone, Sr. Director WW Business Development Automated Security Control August 2013
- 2. © 2012 ForeScout Technologies, Page 2 About ForeScout ForeScout is the leading global provider of pervasive network security solutions for global 2000 enterprises and government organizations. • Independent Network Access Control (NAC) market leader Foundation • 1400+ global implementations • Financial services, government, healthcare, manufacturing, retail, education… • Cupertino HQ, 195 employees • 200+ global channel partners Enterprise DeploymentsMarket Leadership **NAC Competitive Landscape April 2013, Frost&Sullivan ForeScout *Magic Quadrant for Network Access Control, December 2012, Gartner Inc. ForeScout Technologies
- 3. © 2012 ForeScout Technologies, Page 3 Top IT Management Concerns Source: Infoworld / Forrester http://www.infoworld.com/d/wp/the-expanding-role-of-mobility-in-the-workplace-211973
- 4. © 2012 ForeScout Technologies, Page 4 Gartner Recommendations http://www.gartner.com/technology/topics/byod.jsp
- 5. © 2012 ForeScout Technologies, Page 5 The Enterprise Challenge: Balance Access Agility With Security • Employees, Guests, Contractors • Smartphones and personal devices • Wireless, wired, VPN • Data loss • Zero-day attacks and malware • Endpoint integrity • Regulations and compliance Security Access Agility Requires real-time, comprehensive visibility Requires real-time, automated controls
- 6. © 2012 ForeScout Technologies, Page 6 Visible Not Visible Limited Visibility Means Security Gaps Endpoints Network Devices Applications Corporate Resources Antivirus out of date… Unwanted application… Encryption/DLP agent not installed… Protection PossibleProtection Possible No Protection PossibleNo Protection Possible Users Non-Corporate ?
- 7. © 2012 ForeScout Technologies, Page 7 Control Automation Advantages ControlCosts (OpEx,CapEx) Control Coverage (risk management) W ithout ForeScout With ForeScout “The financial institution selected ForeScout CounterACT [and] was able to save over $1,000,000 per year in endpoint support costs... The automation achieved via ForeScout CounterACT reduces help desk call volume, initiates fewer job tickets for software maintenance workflows, causes fewer image refreshes, and increases user productivity.” Continuous Endpoint Compliance: An Ogren Group Special Report April 2011
- 8. © 2012 ForeScout Technologies, Page 8 ForeScout CounterACT Platform . Mobile Security Network Access ControlEndpoint Compliance • Block intrusions • Detect infected machines • Stop targeted attacks Threat Prevention • Real-time device intelligence • Find and fix security gaps • Enforce policies • Register guests • Block unauthorized users and devices • Limit access • Enable BYOD • Secure device, app and data use • Integrate with Wireless and MDM ForeScout Real-timeForeScout Real-time Security PlatformSecurity Platform InteroperableInteroperable ScalableScalableAgentlessAgentless KnowledgebaseKnowledgebase Unique Network PresenceUnique Network Presence ExtensibleExtensible
- 9. © 2012 ForeScout Technologies, Page 9 ForeScout CounterACT Functions Real-time Network Asset Intelligence • Device type, owner, location • Security posture, applications Email CRMWeb Guest User Sales Network Access Control • Block, allow, limit network access • Register guests Automated Endpoint Enforcement • Remediate OS, configuration, security agents • Start/stop applications, disable peripherals • Block worms, zero-day attacks, unwanted apps X
- 10. © 2012 ForeScout Technologies, Page 10 ForeScout Security Policy Engine Switch VPN Wi-Fi Dir, Database SIEM Windows (WSUS, SCCM) Mac, Linux, iOS, Android MDM Antivirus Advanced Security and Operational Integration VA
- 11. © 2012 ForeScout Technologies, Page 11 Gartner Recommendations “Combine NAC and mobile device management (MDM) to enforce policies in a BYOD environment. Personally owned devices that are not managed by MDM agents should be limited to Internet access only, or placed in a limited access zone where they can access a subset of applications and network resources as per user/group role.”1 “The network security team should be part of the overall project team that defines how BYOD will be supported. NAC should be an integral component of the overall architecture, so that the network has the ability to restrict access to devices that are noncompliant with BYOD policies.”2 1 Gartner, “Securing BYOD With Network Access Control, a Case Study”, 29 August 2012, Lawrence Orans 2 Gartner, “Getting Your Network Ready for BYOD”, 28 September 2012, Lawrence Orans
- 12. © 2012 ForeScout Technologies, Page 12 MDM Integration
- 13. © 2012 ForeScout Technologies, Page 13 – Device connects to network Classify type Check for mobile agent – If agent is missing Quarantine Install agent – When agent is activated Check compliance Allow access Continue monitoring ForeScout CounterACT ) ) ) ) ) ) ) ? The Benefits of ForeScout-MobileIron Integration Automated Registration Your Enterprise Network
- 14. © 2012 ForeScout Technologies, Page 14 Automated MDM Enrollment User contacts help desk Without ForeScout: Manual Effort Help desk asks questions, determines device type and ownership Help desk denies request or sends user appropriate MDM enrollment information User enrolls device in MDM Device accesses network With ForeScout: Automation ForeScout discovers and categorizes device, authenticates user ForeScout automates MDM enrollment decision and provides information to user User enrolls device in MDM Helpdesk asks networking team set policy exception allowing internet access to get the MDM app Helpdesk asks networking team to reset the policy exception
- 15. © 2012 ForeScout Technologies, Page 15 – Device connects to network – ForeScout asks MobileIron to provide real-time compliance assessment – If device is not-compliant, CounterACT blocks device and sends message to end-user – End-user corrects the problem on his mobile device – MobileIron confirms compliance, then ForeScout allows the device onto the network The Benefits of ForeScout-MobileIron Integration On-access Compliance Assessment ) ) ) ) ) ) ) ? ForeScout CounterACT Your Enterprise Network
- 16. © 2012 ForeScout Technologies, Page 16 MDM + NAC = complete BYOD security Secure Mobile App Mgmt (Distribution, Config.) Inventory Management Mobile Device Management (App Inventory, Remote Wipe, etc.) Policy Compliance (Jailbreak detection, PIN lock, etc.) Secure Data and Content Guest Registration Network Access Control (Wireless, Wired, VPN) Cert + Supplicant Provisioning Mobile + PC Device-based controlDevice-based control Network-based controlNetwork-based control Network Threat Prevention Visibility of Unmanaged Devices
- 17. © 2012 ForeScout Technologies, Page 17 MDM + NAC: 1 + 1 = 3 NAC focus is network MDM focus is mobile device MDM Alone NAC Alone MDM + NAC Visibility Full info on managed mobile devices only Basic info on managed and unmanaged devices Complete Network Access Control None Full Complete Compliance Mobile devices PCs, Mac, Linux Complete Deploy Agent Pre-registration Network based Both
- 18. © 2012 ForeScout Technologies, Page 18 Unified Compliance Reports
- 19. © 2012 ForeScout Technologies, Page 19 How CounterACT Works ForeScout CounterACT • Out of band • Clientless • One appliance Deploy at the Core
- 20. © 2012 ForeScout Technologies, Page 20 End-To-End Security Automation
- 21. © 2012 ForeScout Technologies, Page 21 ( ( ( ( ( ( ( See Grant Fix Protect • What type of device? • Who owns it? • Who is logged in? • What applications? ForeScout CounterACT
- 22. © 2012 ForeScout Technologies, Page 22 See Grant Fix Protect
- 23. © 2012 ForeScout Technologies, Page 23 See Grant Fix Protect • Grant access • Register guests • Block access • Restrict access ( ( ( ( ( ( ( ForeScout CounterACT
- 24. © 2012 ForeScout Technologies, Page 24 See Grant Fix Protect Email CRMWeb Guest Employee Guest Sales
- 25. © 2012 ForeScout Technologies, Page 25 See Grant Fix Protect • Remediate OS • Fix security agents • Fix configuration • Start/stop applications • Disable peripheral ForeScout CounterACT
- 26. © 2012 ForeScout Technologies, Page 26 See Grant Fix Protect
- 27. © 2012 ForeScout Technologies, Page 27 See Grant Fix Protect • Detect unexpected behavior • Block insider attack • Block worms • Block intrusions ForeScout CounterACT
- 28. © 2012 ForeScout Technologies, Page 28 See Grant Fix Protect MOVE & DISABLEMOVE & DISABLERESTRICT ACCESSRESTRICT ACCESSALERT & REMEDIATEALERT & REMEDIATE Deploy a Virtual Firewall around an infected or non-compliant device Reassign the device into a VLAN with restricted access Update access lists (ACLs) on switches, firewalls and routers to restrict access Automatically move device to a pre- configured guest network Open trouble ticket Send email notification SNMP Traps Syslog HTTP browser hijack Auditable end-user acknowledgement Self-remediation Integrate with SMS, WSUS, SCCM, Lumension, BigFix Reassign device from production VLAN to quarantine VLAN Block access with 802.1X Alter login credentials to block access Block access with device authentication Turn off switch port (802.1X or SNMP) Terminate unauthorized applications Disable peripheral device
- 29. © 2012 ForeScout Technologies, Page 29 See Grant Fix Protect
- 30. © 2012 ForeScout Technologies, Page 30 Automated Security Benefits Function Improve Security Save Time or Money Improve Productivity Detect and control personal devices Provision guest network access Endpoint compliance and remediation Block zero-day attacks with 100% accuracy Real-time compliance and inventory reports Enforce usage policies (apps, devices, …) Quarantine rogue devices Real-time visibility
- 31. © 2012 ForeScout Technologies, Page 31 IT NAC Case Study Large Bank, well over 150,000 endpoints under NAC management Business Problem •No real-time network intelligence: who/where/what endpoints, users and rogue AP’s connected on corporate network? •What percentage of endpoints and network devices are compliant with company’s security policy? •No centralized visibility of enterprise-wide threat activity and compliance reporting per LOB •No way to quickly and easily remediate non-compliant end-points and wireless access-points – more manual and too late •No control over corrupted, inactive or non-existent endpoint configuration, security and compliance agents? SIEM •Executive dashboards with enterprise threat visibility •Enterprise-wide event correlation •On-demand compliance reporting per LOB NAC •Real-time visibility: all users / devices / apps / rogue devices •Asset profiles, access, violations and actions send to SIEM •Automated remediation of endpoint security and config. agents •Works with existing infrastructure and endpoint protection products Benefits • Enterprise threat visibility • Reduced business risk • More responsive security • Operational efficiency • Automated remediation • Endpoint compliance • Demonstrable GRC gain Benefits • Enterprise threat visibility • Reduced business risk • More responsive security • Operational efficiency • Automated remediation • Endpoint compliance • Demonstrable GRC gain What’s Next • Expand global deployment • Mobile security • More remediation policies • Add business intelligence What’s Next • Expand global deployment • Mobile security • More remediation policies • Add business intelligence
- 32. © 2012 ForeScout Technologies, Page 32 • Easy to deploy – Clientless – No infrastructure changes – Everything in a single appliance • Rapid time to value – Complete visibility in hours or days • 100% coverage (no blind spots) – Users, devices, systems, VMs, apps • Extensive range of automated controls – Transparent, gentle, or aggressive • Works with every network without costly upgrades Why Customers Choose ForeScout
- 33. © 2012 ForeScout Technologies, Page 33 Customer Testimonial Anthony Maciel, Director, Technology Support Services Golden West College “Literally, an hour after dropping a ForeScout appliance on our network – Bang! I could see everything that was going on.” “ForeScout CounterACT solved our data security problems perfectly. It gives us 100% visibility and control.” Todd Frazier, Systems Administrator, Culpeper County Government “ForeScout was simple – one box, one day to install ... and agentless operation. It met all our needs, and we had to make no changes to our network. That’s why we chose ForeScout – simple, cost effective, easy to use.” John Shields, Sr. Vice President and CTO Patelco Credit Union
- 34. © 2012 ForeScout Technologies, Page 34 Thank You *This Magic Quadrant graphic was published by Gartner, Inc. as part of a larger research note and should be evaluated in the context of the entire report. The Gartner report is available upon request from ForeScout. Gartner does not endorse any vendor, product or service ]depicted in our research publications, and does not advise technology users to select only those vendors with the highest ratings. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. Garnter, Inc. "Magic Quadrant for Network Access Control," Report G002129752, December 3, 2012, Lawrence Orans, John Pescatore.
Notes de l'éditeur
- I’d like to spend most of my time today talking about YOUR network security and how we might be able to help make it more effective and efficient, but let me just give you one slide about who ForeScout is. In business 13 years Focused on pervasive network security Ranked a market leader by all the major analysts, such as Gartner, Forrester, and Frost and Sullivan Over 1400 customers, many of whom are large multinational organizations with over 100,000 endpoints ========================== DISCLAIMER (NOT TO BE READ) *This Magic Quadrant graphic was published by Gartner, Inc. as part of a larger research note and should be evaluated in the context of the entire report. The Gartner report is available upon request from ForeScout. Gartner does not endorse any vendor, product or service depicted in our research publications, and does not advise technology users to select only those vendors with the highest ratings. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose. Gartner, Inc. "Magic Quadrant for Network Access Control," Report G00238941 , December 3, 2012, Lawrence Orans, John Pescatore ***Frost & Sullivan chart from 2013 market study Analysis of the Network Access Control Market ”
- JACK cover this slide. This research was performed by the market research team at Forrester Research and published by InfoWorld. The study asked IT security managers to describe the most important security concerns. We can see that network security was the top concern, followed by data security, and device security.
- Gartner has published a large amount of research on BYOD, and they frequently give webinars in which they present their recommendations on what types of security products enterprises should invest in to ensure that BYOD is done securely. Most of these webcasts they give are free for you to watch.
- The key problem that we address – what makes us sort of unique – is our ability to help customers balance “access agility” with security. [click to advance] What I mean when I say “access agility” is the ability to have all kinds of people, and all kinds of devices such as smartphones, connecting to your network through many different types of connections. This is what is happening today, it is the road warrier experience, ant it is driving increases in productivity. [click to advance] Of course you have to be concerned about security. You lose a laptop or a smartphone that has corporate data on it, you have a data loss event. Are all the many devices like iPads running antivirus? You bet they are not, and you don’t control those devices anyway, so this is a potential threat vector. What does all this mean with respect to regulations and compliance? It is a concern, because many of these mobile devices are devices that you do not control. Yet you remain responsible for network security. [click twice to advance] To manage these risks and enable the business benefits of accessibility requires a solution that provides visibility and control which is seamless to the end user and highly automated for IT. Now …. Let me expand on the idea of comprehensive visibility. Because it is extremely important. You can’t secure what you can’t see. Let me illustrate what gaps you might have today that ForeScout could help with.
- Let’s start with visibility of your corporate resources. The little blue shapes on the screen represent your corporate IT assets. You have Endpoints, Network Devices, Applications, and of course users. You typically know about all these things, don’t you? Because you’ve bought them, and because the employees are on your payroll and in your directory. Now … you secure your endpoints with various security tools, right, like antivirus agents, encryption agents, data loss prevention agents, patch management systems and so forth. Right? You’ve spent lots of money on all these good systems. But the truth is that security agents are hard to maintain, and these systems don’t work correctly 100% of the time. Based on data we’ve gathered from our customers, we know that each security agent will not be working correctly on between 10% and 15% of the endpoint devices. Why? Well, the antivirus might be out of date. Or the personal firewall might be misconfigured. Or maybe the encryption agent is not properly installed. This is reality. There are various studies that support these numbers. Now … you probably have at least three desktop agents in your organization, if not four, five or even more. That’s common. [click to advance the build] These colored “Xs” show the different endpoint agents that aren’t working properly in the real world. When you add them all up, it’s typical to find security problems on one third of your endpoints. In fact, a few years ago, Microsoft published a report that showed over 50% of their endpoint computers had a security problem because of these types of failures. Over 50%! [click to advance the build] OK, so there are also non-corporate assets. The reality is you have non-corporate assets on your network. Employees bring in personal laptops. Contractors bring in their own systems. Not to mention all the iPhones and iPads that are brought in by visitors and by employees. Move down to the next category — network devices. Employees bring rogue network devices into the office and connect them to your network. They’re innocently trying to “help themselves” by working around your IT organization. Right? You know this happens. Think about applications. Do you have any security policies against running certain types of applications? Like instant messaging or Skype? Password reminder applications? Remote access applications? Employees want to run risky applications. Do you have visibility to this? And are you able to stop it? And of course you have non-corporate users on your network. Guests and contractors. Typically enterprises don’t have good visibility into any of these things. But they are on your network, and they can be security risks as well as operational risks. [click to advance the build] Unless you have the technology that can show you everything touching your network, you probably only have visibility into one-half of what’s actually there. [click to advance the build] As for the rest of your network? Zero visibility. [click to advance the build] The result is you have gaps in protection because you can only protect what you know about. [click to advance the build] Luckily for you ForeScout solves this problem. ForeScout gives you complete visibility and a means to enforce security policy for EVERYTHING touching your network. This is real-time visibility and proactive control. And it’s highly automated. Now the other half of the equation is control. Visibility is great to see all the problems, but you also need controls to fix the problems. Let me say a few words about controls.
- It is highly advantageous to implement automated controls, and this graph shows why. If you have a manual control system, your costs go up as you increase your control coverage. This is pretty much by definition. I know that some of your systems are already automated, but some are probably not. We can talk about the details later. But my point is [click to advance the build] Everything is automated with ForeScout’s platform. So once you purchase it, and once you setup your policies, ForeScout automates your security coverage, which keeps your costs low. According to a report issued by The Ogren Group in April of 2011, one large customer has actually quantified the cost savings they have achieved with ForeScout CounterACT. The answer is over $1,000,000 per year.
- ForeScout provides complete visibility and control of everything on your network, and helps you enforce endpoint compliance. The functions are shown at the top of this slide, but what our customers love is how easily we do it: [click to advance the build] It’s agentless – which means there is no software that you have to install. We do provide agents for customers that want certain forms of advanced security, and this is especially important for mobile device management. But by and large, our customers are amazed at the functionality that they can obtain without an agent. It’s on the network, connected passively via a mirror port or span port, and it dynamically sees and assesses all network activity. Our platform is scalable. We have customers managing 250,000 endpoints on our system. We provide an integrated knowledgebase of the most common policies that you can configure with a simple mouse click Our platform can be integrated with a wide variety of existing IT systems, such as inventory databases, SIEM, MDM systems, etc. And our solution is completely interoperable with your existing network infrastructure and endpoint security systems. We integrate with all major brands of equipment and software. No upgrades or changes are needed to your infrastructure.
- What does our product do? Well, the main functions are shown here. The first function is to show you everything on your network. You get 100% visibility, and you can see who owns each device and assess its security posture. If a security agent is not functioning properly on a PC somewhere, ForeScout tells you about it. [CLICK to advance] The second function is to automatically perform some sort of action. The actions shown in this box are to control network access, based on policies that you setup. Many other actions are available, such as sending an alert to the administrator, the end-user, or a third party application. [CLICK to advance] The third function is to fix whatever security problems have been found in step 1. If a vulnerability has been discovered, ForeScout CounterACT can trigger your existing patch management system or configuration management system to fix the problem, or you can program CounterACT to directly fix the source of the problem. CounterACT can install applications, start applications, stop applications, even disable peripheral devices.
- Let me demonstrate three such examples. First, I’m going to describe how CounterACT integrates with MDM systems. Then I’ll describe how CounterACT integrates with databases. And finally I’ll describe how CounterACT integrates with SIEM systems.
- Among the published recommendations that Gartner gives their clients is this set of recommendations, which are very important to today’s webcast. Gartner recommends that organizations combine NAC and MDM to enforce policies in a BYOD environment. They say that (read slide). So let’s talk more about this and dive a little deeper into how NAC and MDM can work together.
- Here are examples of some of the leading MDM systems. Normally, these systems operate pretty much as islands, or silos of information. ForeScout CounterACT solves that management problem by integrating with them bi-directionally. That gives you several major security and operational benefits, as listed in the lower right corner of this slide. I will illustrate two of these in detail.
- When you combine ForeScout CounterACT with MobileIron, you get some synergies that improve security and save you money with operational efficiency. Let me illustrate two examples of this: One is how the onboarding process becomes more efficient, and the second example is how security posture assessment of mobile devices can become on-demand, to improve security. To start off this animation, notice that we begin with two products – MobileIron and ForeScout CounterACT So a new device tries to access your wireless access point. Immediately ForeScout CounterACT learns about it. CounterACT figures out what kind of device this is – Apple device? Android? Then ForeScout asks MobileIron if it is aware of the device. Is this a managed device? In this example, MobileIron returns an answer that it does not know about the device. [CLICK TO ADVANCE] So ForeScout quarantines the device [CLICK TO ADVANCE] And sends the user to a web page where the user can enroll his device into MobileIron. It’s all automatic. The end user does not need prior knowledge of the MDM system, and your helpdesk does not need to get involved. [CLICK TO ADVANCE] The endpoint now communicates with MobileIron. MobileIron checks whether the endpoint is compliant with your security policies. If the device is compliant, then MobileIron reports this to ForeScout CounterACT. CounterACT communicates with the switch, lifts the quarantine, and allows the device to access your enterprise network. It’s that simple.
- The second benefit I would like to illustrate is how ForeScout helps automate the enrollment of devices in your MDM system. When you have ForeScout on your network, it automatically discovers new devices the moment they try to connect to your network. ForeScout communicates with your existing MDM system to figure out whether a new device is supposed to be enrolled into the mDM system. If it is, then ForeScout automates that enrollment. Without ForeScout on your network, the process is much more manual. Typically the end user needs to first contact the help desk, who asks the end-user some questions, and there are several more manual steps.
- The first thing I want to illustrate is what we call On-access compliance assessment. Let me set the stage. You can configure MobileIron to check the compliance of mobile devices every so often, but in order to not consume too much battery life of the mobile device, many customers configure the interval to 12 hours or 24 hours. And so many of our customers are quite security conscious, and they want to know in real-time, the moment that a device tries to access the network, whether the device is compliant. The moment the mobile device enters your network, that is a critical moment , because it offers a possibility for infection to spread or data loss to occur. So here is how ForeScout and MobileIron solve this problem. [CLICK TO ADVANCE] So immediately when a mobile device connects to your network, ForeScout learns what has happened. [CLICK TO ADVANCE] ForeScout will ask MobileIron to report the compliance status. [CLICK TO ADVANCE] In this case, let’s say that MobileIron will report back that the compliance information is stale or that the device is not compliant. In this example, I’m showing that the mobile device has been jailbroken. ForeScout CounterACT blocks network access and sends the end-user a message, telling him why he has been denied access. [CLICK TO ADVANCE] Once the end-user fixes the security problem on his mobile device, he triggers MobileIron to re-assess compliance. [CLICK TO ADVANCE] If MobileIron confirms that the device is compliant, then ForeScout CounterACT will allow the device onto the network.
- This is one of my favorite illustrations that show you how combining MDM with NAC gives you a more complete security solution. MobileIron’s expertise is with mobile devices. ForeScout’s expertise is with the network and everything touching it. And you really need both in order to have optimal security and optimal efficiency.
- When you combine MDM with NAC, you gain a more complete security solution, and you also gain some valuable automation which saves time and money. There are four basic ways that ForeScout and MobileIron have integrated our products. Of course, MobileIron’s focus is on the mobile device, and ForeScout’s focus is on the network. And when you combine the two products together, you get more complete visibility as shown here. If you want to see unmanaged devices on your network, you need NAC. Period. If you want to control where users can go on your network, to protect data on your network, NAC is what you need. If you want to manage the compliance of devices on your network, you must have MDM in order to manage the compliance of mobile devices, and NAC can manage the compliance of PCs, Macs and Linux machines. So together, you have complete coverage. And last is the problem of deploying agents onto mobile devices. MDM and NAC complement each other and together provide a more efficient, more streamlined, more automated way to get mobile devices enrolled into your MDM system. So now for the next few minutes, I’m going to talk about ForeScout’s product line, and then John Briar will talk about MobileIron’s product line, and then we’re going to show you how these two products work together to deliver a really strong, highly automated solution for BYOD security.
- The first benefit that I want to illustrate is unified compliance reporting. ForeScout CounterACT pulls information from the MDM system, adds this information to what CounterACT already knows about the PCs on your network, and lets you produce unified compliance reports such as the sample shown here. This report encompasses iPads, Androiid devices, windows machines, MacOS systems – everything on your network. Obviously, going one place for a compliance report saves you time and money compared with the alternative of going to separate systems to produce separate reports.
- The name of our product is ForeScout CounterACT. CounterACT is an appliance that installs out of band at the core of your network. You can deploy it in other places, there are several other deployment scenarios which are possible, but it’s very simple to deploy at the core. The clientless mode of operation is very popular, but you can also easily utilize ForeScout’s lightweight client if you wish.
- Once installed, our product lets you follow the process shown in this cycle diagram: First we give you visibility into what is on your network. We let you “ see ” everything. We tell you what is on your network, and we give you deep information about the devices including their security posture and who is logged into the devices. Then we grant network access as per your security policy. The policy that you choose to enforce is up to you. Our system is very flexible, for example if you prefer to grant access very liberally and only block access to computers that are seriously infected, that is up to you. This is also the stage where our product can limit access to just portions of your network, or maybe just grant Internet access. The fourth step is Remediation. Our product not only finds the security gaps, it fixes them. Finally, we continuously inspect the traffic from ever network device to protect your network against attacks. Our system contains zero-day protection that was effective on day zero against Conficker, Zeus, and Stuxnet. Let me show you details of how this entire cycle works. Let’s start with “see”.
- Our appliance tells you – in real time – what is on your network. [click to advance the build] We detect endpoints, network devices, users and applications.
- This is an screenshot of our system showing you mobile devices that are on your netowrk.
- The next step is to grant network access. One of the things that has made ForeScout successful with Network Access Control is the range of actions that we allow customers to take. They range from gentle actions such as sending alerts to the administrator, educational actions such as telling the user that they are violating a policy, or more assertive actions such as restricting network access. If you don’t want unauthorized devices or people on your network… [click] CounterACT can remove them. Automatically. Our product works with virtually ALL brands of network infrastructure. Cisco, Brocade, HP, Dell – we work seamlessly with all major brands of network infrastructure. So those unauthorized devices are now gone from your network. But you still might have some problems with the authorized endpoints themselves. That is where our second level of automated enforcement comes into play. Automated endpoint remediation.
- Guest networking is bread-and-butter for us. This is an example of a guest registration page that our product puts up when an unrecognized device connects to the network. The user sees this page when he opens a browser. You can customize the page to say whatever you want. (CLICK to activate the animation) Many organizations go further and use our product to control who goes where on the network. As this graphic shows, you can allow guests to access the Internet, you can allow employees to access different network resources depending on the employee’s role or group membership in your directory, and you can allow specific types of employees or contractors to access resources that are appropriate for the work that they need to do.
- We help you find and fix problems with your endpoints. [click] Update the operating system. [click] Disable USB memory sticks. [click] Kill applications you don’t want running. All this is from a single network appliance. And it’s all automated, saving you time and money. Our customers experience significant cost savings because of this automation.
- This shows you some of the remediation capabilities that are built into our platform.
- And there’s one more thing: CounterACT includes built-in threat prevention that has the smarts to detect when an otherwise “good” endpoint has gone bad due to some sort of infection or compromise. Our technology is extremely effective. In fact, CounterACT provided zero-day protection against Conficker, Zeus, even against the infamous Stuxnet Trojan.
- CounterACT includes a range of actions, ranging from gentle, to more assertive. This makes rollout of our product very successful.
- And the cycle repeats. We’re back to “see” and we give you reports on the compliance of everything on your network.
- Unlike other security products, ForeScout’s product has a direct ability to reduce costs and improve productivity.
- US Mil were using Cisco system RADIUS - then switched to ForeScout CounterACT. When upgraded to 7.0, they switch back to Cisco, and got 600 calls on the day they disconnect CounterACT Host not configured properly – Cisco say: not authorized, policy disconnect the host, help-desk get call from user, Desktop jeep drive to the user. Need to call the networking team to set as expectation. US Mil. Account: Bought $1.2 M of gear. 10 appliances for SIPRnet and 10 appliances for NIPRnet HQ has 10,000 devices, and 7 remotes sites (2500 each) for each of the two networks. Purchase motivation Primary purchase motivation was difficulty deploying 802.1x. It was taking 80% of their top network administrators time to deal with 802.1x issues. They wanted some way to automate it. During the POC, we set up a policy that made use of dynamic ACLs and a script for installing the 802.1x supplicant. If a device failed, the administrator would see it, and if he blessed it, he could hit a button and the script would push the supplicant to the endpoint. Usage: Deal with 802.1x supplicants. Their goal is to get to compliance checking for other security features as well, like A/V. Competitive vs Cisco: At one point Cisco came in and tried to sell their NAC, but it took the network down during the pilot, whereas ours worked like a champ, even unattended while the administrator was out recovering from his motorcycle accident. Cisco had a webex open for over a week with a whole team working behind the scenes trying to get it up and they failed to get it working. FS got it working in an afternoon!!
- Just before I wrap up, I want to let you know the five most important reasons why customers choose our product over other solutions. Because each of the five things that I’ve shown you our product does, you can go out and buy a product that does – or says it does – each of those five things. We interview our customers after they purchase our product, and we ask them “Why did you purchase ForeScout over another brand? Did you look at any other brands?” The answers that we get back are shown here on this slide. (Read the main bullet points only – do not digress into detail!)