University:
Boston University
Course:
MET CS 201 | Introduction to Programming
Academic year:

2021
Views:

304

Pages:

19
Author:

Heath Houston

User Authentication in the Enterprise Network Expectations: Utility-Like Data Services z High performance (bandwidth) z Predictability (latency, delivery, etc) z Availability (total service availability) z Reliability (utility-like uptime characteristics) z Cost effective (system wide TCO) z QoS capabilities (business policies) z Simplicity (non-complex) z Manageable (visibility) z And ??????? A Traditional View of Security z Keep the “Bad Guys” out! z Lock the doors. z Ignore the problem until… Internet Internet IDS R X R R X IDS R A Traditional View of Security z Any point of access to the network can allow a security breach Internet Internet VPN IDS R R R X AP X IDS R Importance of Infrastructure Security z Trouble can come from outside or inside —"Traditionally, about 70% of security breaches were being reported as having originated from within the organization itself" - META Group z There are many security holes in most networks —The idea of the “trusted machine” is obsolete —Unnecessary daemons (processes) running on networked machines allow vulnerabilities to be exploited —Defaults (passwords, SNMP community strings, etc) are often left in equipment creating vulnerabilities. —"Network complexity combined with a never-ending stream of software upgrades and patches leave many networks vulnerable to attack" - IDC The Threat from PETE “One in 700 employees is actively working against the company” “75% of all technology losses occur from employees and those with trusted relationships” http://www.asisonline.org Trends in Intellectual Property Loss So What About Authentication? z Who Authenticates today? — Remote Access Users (dial-up) — VPN Users — Everyone – to the Domain and Application Servers ? Logon The Need for User Based Authentication Extending the traditional Authentication boundaries of the enterprise network enables security and personalization. Current Authenticated Areas 802.1X Authenticated Areas Enterprise WAN Internet RAS Server / NOS / Directory IEEE 802.1X z Leverages well defined Extensible Authentication Protocol (EAP) {RFC 2294} with some specific extensions for characteristics of 802 LANs (EAPoL) z EAP is a general protocol supporting various authentication methods (MD5, TLS, Smartcards, Certificates, PKI, 2-Factor, etc.) z 802.1X is a method for performing authentication to obtain access to IEEE 802 LANs. z Ideally occurs at the first point of attachment (edge device) z Specifies a protocol between devices desiring access to the LAN and devices providing access to the LAN z Specifies the requirements for a protocol between the Authenticator and an Authentication Server (e.g. RADIUS) z Specifies management operations via SNMP Definitions z Authenticator — An entity that requires the device on the end of an attached link to be authenticated. z Supplicant — The device entity requesting to be authenticated by the Authenticator and thereby gain access to the services of the Authenticator. z Authentication Server — An entity providing authentication administration to the Authenticator. General Topology EAPoL Supplicant RADIUS Authenticator Authentication Server Authentication Process EAPoL Supplicant RADIUS Authenticator Authentication Server EAP Start RADIUS Access-Request EAP Response/Identity RADIUS Access-Challenge EAP Request RADIUS Access-Request EAP Response (cred.) EAP Success! ACCESS ALLOWED! RADIUS Access-Accept RADIUS EAPoL EAP Request/Identity Why is Authentication So Important? z The Obvious z The Not So Obvious… The User Personalized Network - UPN z Mass Customization of the application and information experience is the unavoidable trend and goal — Past : www.yahoo.com — Present : www.myyahoo.com — Future : www.JohnSmith.com or just “John Smith” z Unfortunately your infrastructure has no idea of the persons using it — We think falsely that we “log into the network” — Infrastructure is not user personalized today z A UPN is: — A heterogeneous virtual enterprise connectivity system that — Provides homogeneous services to people — Based on their relation to the business The Current Model To date, ships in the night The Network… IP interface add 134.141.x.x/24 vlan blue IP route add static 134.141.130.x/24 ACL 100 IP permit 134.141.x.x 192.168.x.x any any VLAN create IP 134.141.x.x interface et.2.5,8 President CEO COO 00-00-1d-08-04-67 VLAN QoS/ToS OSPF BGP IMTU 802.1x 134.141.x.x SNMP VOIP 12,073 (121,098) (1,23) (8,467) (101,601) (240) ========= XXX,XXX CFO “The Directory” Revenue Utilities IT budget Gambling Compensation Restocking ========== Net Income The Business… Aligning IT with the Business Model The User Personalized Network understands who individual users of a network system, as well as their relationship to the business. UPN allows you to manage a user’s relationship to the organization through the use of Profiling and Authentication. By configuring peoples access to services and information, a new paradigm is realized…. Person = Behavior Intranet ERP Print Internet Voice Network Admin R&D Net Admin Mainframe Video Email IT Services Executive Sales Business Roles 4 Stages of the User Personalized Network Service Provisioning Authorization and Role assignment User Name & Credentials Authentication RADIUS Server Profile Creation and Distribution The new IT/Business Model The Business rules are enforced by the network system President CEO COO CFO “The Directory” Increased Customer Satisfaction Business Increased Profitability Justified IT Expenditures Cost Reduction IT Summary Understanding the Problem Is the Only Way to a Solution... The Problem: •Aligning IT with the Business •Securing Mission-Critical Data •Deploying QoS,CoS Easily and in a Meaningful Way The Solution: Enterasys User Personalized Network Role-Based Administration Authentication—John Roese (Enterasys CTO) co-authored the standard Role-Based Administration— Innovation in software to match IT rules with business roles Service-Enabled Edge—Years of experience in architecting advanced features in our products. Service-Enabled Edge User Personalized Network Authentication Person = Behavior