CSA for Mobile Client Security

CSA for Mobile Client Security

1. defense-in-depth approach to security, including comprehensive endpoint security that is critical to effective threat detection and mitigation, and policy enforcement.

2. Both mobile and fixed clients and servers are exposed to a range of security threats, including viruses, worms, botnets, spyware, theft of information, and unauthorized access.

3. CSA offers the ability to extend general endpoint protection to address the typical threats encountered by a mobile client and adapt the security policy being enforced according to their current location.

4. CSA addresses the threat posed by simultaneous wired and wireless connections by restricting traffic over the wireless network if an Ethernet port is active.

5. CSSC is a software client that manages the user identity, device identity and network access protocols required for secure access to both wired and wireless networks.

6. One of its features includes the ability to block wireless access if a wired port is active.

7. A wireless ad-hoc network is when two or more wireless nodes communicate directly on a peer-to-peer basis with no wireless network infrastructure. This is also referred to as an independent basic service set (IBSS).

8. Wireless ad-hoc networks are typically formed on a temporary basis to rapidly enable communication between hosts, such as to exchange files during a spontaneous meeting or between hosts at home.

9. Simultaneous wired and wireless connections occur when a client has an active connection on a wired network (typically, over Ethernet), as well as an active wireless connection, such as to an open WLAN, a secure WLAN, or a wireless ad-hoc network.

10. Simultaneous wired and wireless connections are typically considered a security risk

11. Location-aware policy enforcement refers to the ability to enforce different or additional security policies according to the network to which a mobile client is connected, based on the perceived security risk associated with their location

12. Mobile clients connect to different networks in different locations and are thus exposed to additional security risks for some of the following reasons

    • Exposure to networks with different security and protection levels
    • Lack of user awareness of an active WLAN connection

13. QoS marking policy enforcement refers to the ability to set or re-mark the QoS parameters of application flows sourced from a host. These markings can be used by upstream devices in a network to classify the packets and apply the appropriate QoS service policies.

    • The goal of QoS marking is to separate application flows into different service classes so that they can be handled according to their particular network requirements and business priorities. Common service classes include the following
      • Latency sensitive applications; for example, voice over IP (VoIP) • Network control traffic • Business-critical applications • General user traffic; for example, e-mail, web • Non-business traffic

14. Upstream QoS marking on a WLAN offers significant benefits because 802.11 bandwidth is a shared medium that is often under contention.

15. Upstream QoS marking on a WLAN endpoint enables 802.11 traffic to be classified and prioritized according to application needs. In a mixed application environment, this enables high priority applications, such as latency-sensitive VoIP applications, to be given higher priority access to the 802.11 medium, thereby preserving service availability.

16. Upstream QoS marking offers significant benefits on a WLAN, but enabling QoS also presents challenges such as the following:

    • • QoS marking abuse or misuse 802.11e and Wi-Fi Multimedia (WMM)-capable devices have the ability to mark upstream packets with QoS classifications, but these self-appraised markings may not always be trusted and are subject to abuse, either because of unintentional higher markings or because of intended abuse, perhaps by compromised hosts.
      • Lack of QoS support on legacy devices Legacy, non-802.11e, and non-WMM devices do not support upstream QoS marking. Consequently, traffic from these devices is not classified or prioritized and is typically handled on a best-effort basis on the WLAN.
        • Lack of QoS support in legacy applications Many applications do not support QoS functionality. Consequently, traffic from these applications is not classified or prioritized and is typically handled on a best-effort basis on the WLAN.

17. CSA v5.0 introduced the ability to apply upstream QoS markings to host application flows on the endpoint. Consequently, CSA can be used to ensure that all upstream traffic leaving a host has QoS markings set according to network policy.

18. The enforcement of CSA Trusted QoS Markings thus ensures that QoS markings are applied to all packets sent by a client, and that they are set in accordance with the network policy. This enables the accurate classification and prioritization of applications, which is particularly critical in a mixed environment consisting of multiple applications and a range of endpoint devices and platforms.

19. To enforce upstream QoS markings on all packets leaving a client, Cisco recommends that CSA Trusted QoS Marking be deployed on all clients. This can be deployed in two stages:

    • 1. Define a default QoS rule module to mark all traffic as best effort. 2. Define additional rule modules to apply the appropriate QoS markings to identified mission-critical applications such as VoIP.

20. Cisco recommends that customers wishing to implement simultaneous wired and wireless policy enforcement consider the following operational aspects of the pre-defined simultaneous wired and wireless ad-hoc rule module:

    • Wireless connection status, Traffic filtering,Client routing table,Non-802.11 Wireless Interfaces,Alternative Implementation