Chapter 2 Security Strategy and Cisco Borderless Network

Chapter 2 Security Strategy and Cisco Borderless Network

1. Cisco Borderless Network Architecture

   • integrated components
     • Borderless end zone
       • Implemented by security controls aimed at protecting end devices and preventing intrusion to and from those end devices. Malware, viruses, and other types of malicious code are commonplace. The borderless end zone is built to detect these threats and eradicate them, or at least mitigate them, even before users connect to the network
     • Borderless Internet
       • Implemented by scanning and enforcement engines, which are deployed onsite and offsite and managed by the organization itself but also by cloud providers. These scanning and enforcement engines inspect network content from Layer 2 through Layer 7, assuming the role of firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS), network proxies, web gateways, and so on
     • Borderless data center
       • Data centers deserve special attention in a cloud-driven business environment. The Cisco Borderless Network Architecture leverages existing infrastructure components such as Cisco Adaptive Security Appliances (ASA), IPS sensors, and switching components such as Cisco Catalyst and Cisco Nexus switches, layering virtualized components on top to provide security solutions that are built for “in the cloud” deployment, “by the cloud” deployment, and “for the cloud” deployment.
     • Policy management layer
       • Security policy is managed in central locations and then enforced throughout the network based on context-specific variables. When an employee on an untrusted network in Moscow checks email via Outlook Web Access (OWA), that employee can view messages but is precluded from downloading attachments.
     • Borderless Network Services
       • Professional and technical services are provided by Cisco and its partners. Cisco and its partners help an organization achieve the full benefits of the deployment of the Cisco solutions by providing consulting services in areas such as wireless, unified communication, data center, and, of course, network security, to name a few.

2. Cisco security portfolio of products solving issues of Borderless Networks

   • Cisco SecureX product
     • secure network
       • ASA
       • IPS
       • CIS router
       • CSM
     • Secure email and WEB
       • IRONport email security Cisco web security
       • Cisco IronPort WSA and ESA both offer solutions to scan outbound traffic against preconfigured and customizable rules, thus preventing corporate or personal information from leaving the organization’s premises.
       • WSA
         • Cisco IronPort Web Security Appliance (WSA), which scans the content of a web page for malware prior to passing it to the inside user who initiated the request
       • ESA
         • Cisco IronPort Email Security Appliance (ESA), which scans incoming email against spam
     • security mobily
       • cisco virtual office cisco adptive wireless IPS cisco anyconnect secure M
     • Secure DC
       • ASA
       • ASA Modulo 6500
       • VSG
     • Secure access
       • cisco identidy services engine (ISE) cisco secure access control system

3. Cisco SecureX Architecture presenting its features and benefits

   • Cisco SecureX is an access control strategy that allows for more effective, higher-level policy creation and enforcement for mobile users, connecting from anywhere, at any time, using any device. Because Cisco SecureX uses a broad array of parameters for policy, it allows for much more effective security and enables situational awareness

4. Cisco threat control and containment products and technologies

   • The Cisco threat control and containment solution offers comprehensive protection for your network through network-wide visibility, simplified policy control, and proactive system protection. The Cisco threat control and containment solution regulates network access, isolates infected systems, prevents intrusions, and protects critical business assets. This solution counteracts malicious traffic such as worms, viruses, and malware before it affects your business, by using centralized policy, configuration, and threat event management.
   • Cisco ASA
     • Cisco ASAs provide proven firewall services and context- and applicationaware capabilities for comprehensive, real-time threat defense. ASAs implement a truly unified threat management service, with the integration of VPN and intrusion prevention technologies in various forms.
   • Cisco ISRs
     • Through software- and hardware-integrated security functions, ISRs can easily become part of the army of security controls in networks of all kinds. These functions include zone-based policy firewall, Cisco IOS IPS, and the integration of SSL and IPsec VPN technologies.
   • Cisco IPS
     • Intrusion prevention is accomplished in a distributed fashion, from IPS 4200 appliances to integrated hardware modules such as the Advanced Inspection and Prevention Security Services Module (AIP-SSM) for ASA or the Intrusion Detection Services Module (IDSM) for Cisco Catalyst 6500. These IPS sensors support a variety of IPS technologies, including signature-based, anomaly-based, policy-based, and reputation-based techniques.

5. Cisco content security products and technologies

6. Cisco VPN solutions and technologies

7. Security management products and technologies