check point虚拟化安全案例amazone_20140723_W

1、Check Point虚拟化安全案例 大客户技术经理蒋 波 Restricted ONLY for designated groups and individuals2014 Check Point Software Technologies Ltd.Amazon Web Services (AWS) Solutions2014 Check Point Software Technologies Ltd.2Amazon Web Services OfferingAWS offers IT infrastructure to businesses in the form of Web servi

2、ces or cloud computingBusinesses have the ability to easily extend their infrastructure and resources in the Amazon Public Cloud2014 Check Point Software Technologies Ltd.3Amazon Web Services SolutionsS3EC2VPCAmazon Simple Storage ServiceA service that provides users a data storage infrastructure(ht

3、tp://S3/)Amazon Elastic Compute CloudA service that lets users rent virtual computers on which to run their own applications(/ec2/)Amazon Virtual Private CloudA private cloud that exists within the public cloud of Amazon. You can run EC2 instances within a VPC(http:

4、//vpc/)AND MORE2014 Check Point Software Technologies Ltd.4Amazon Cloud ArchitectureCustomers IsolatedResourcesS3EC2VPC Internet GatewayEC2VPCEC2Public Cloud2014 Check Point Software Technologies Ltd.5Introduction to Amazon Virtual Private Cloud (VPC)Amazon VPC enables the creation of

5、a virtual network topology including subnets and routing for Amazon Elastic Compute Cloud (EC2) resourcesAmazon VPC enables enterprises to connect their existing infrastructure to a set of isolated AWS resources via VPN connection or directly through the InternetCheck Point Virtual Appliance secures

6、 the VPC2014 Check Point Software Technologies Ltd.6Amazon VPC Topology and ComponentsInternet55Direct connectivity toInternet or over VPN44AmazonAmazon VPC internet gateway3VPC3Amazon VPC router22Check Point VirtualAppliance for VPC11AWS EC2 instances in1private subnets2014 Check Point Software Tec

7、hnologies Ltd.7Amazon VPC ScenariosVPC with Private Subnet andVPN AccessVPC with Public SubnetVPC with Internet ConnectivityVPC with VPN ConnectivityVPC with Public and Private SubnetVPC with Private and Public Subnet and VPN Access2014 Check Point Software Technologies Ltd.8How toSecure Amazon VPC

8、with Check Point Virtual ApplianceVirtual Appliance for Amazon Public CloudPublic Cloud2014 Check Point Software Technologies Ltd.9Network topology with Amazon VPC and Check Point Virtual Appliance+HQVPNVPCPublic Cloud Virtual ApplianceSecurity Policy: Public Cloud2014 Check Point Software Technolog

9、ies Ltd.10Manage Your VPC EnvironmentConfigure your Check Point Virtual GatewayAmazon VPCCentrally manage all your network2014 Check Point Software Technologies Ltd.11Full Range of Protections for the CloudChoose the Right Software Blades for Your Security NeedsPublic Cloud2014 Check Point Software

10、Technologies Ltd.12Check Point Extends Security to Public CloudThe First Next-Generation Firewall in the Public Cloud!VPCPublic Cloud Virtual ApplianceSecurity Policy: Public CloudSecurity Policy: On-premise2014 Check Point Software Technologies Ltd.13Public Cloud Security ChallengesNetwork AttacksC

11、heck Point Firewall, IPS Multi TenancyDedicated VPC InstancesAccess ControlCheck Point Firewall, VPNData Security CompliancyCheck Point DLPCheck Point Security Management2014 Check Point Software Technologies Ltd.14ADVANCED SECURITYfor Amazon Public CloudFull ProtectionQuick DeploymentPublic CloudUn

12、ified Management2014 Check Point Software Technologies Ltd.15ADVANCEDSECURITYfor Amazon Public CloudFull ProtectionSimple DeploymentUnifiedVMirtuaanl Aapgpeliamncee nfotr Amazon Public CloudPublic Cloud2014 Check Point Software Technologies Ltd.16附：Check Point云安全技术方案 Restricted ONLY for designated g

13、roups and individuals2014 Check Point Software Technologies Ltd.17虚拟化带来的新安全挑战 安全架构的变迁 软硬件边界模糊 网络和主机混合 虚拟主机部署、变更 高速部署 Inter-VM数据流检测 动态vMotion、DRS、VMwareHA 虚拟主机生命周期 迁移、回滚 安全架构的融合 物理环境安全 虚拟环境安全 2014 Check Point Software Technologies Ltd.18如何建立云安全？ 通过VLAN对虚拟机进行分段？ 难于管理 责任不明确 盲点 延迟 2014 Check Point Softw

14、are Technologies Ltd.19解决安全挑战虚拟化担忧我们的解决方案SGVEVM泛滥每台新虚拟机从一创建就受到保护Guest逃避VE在管理程序层进行检查配置错误基于策略的安全，而不是VLANsVMotion自动和透明地跟踪VM安全管理程序层由于SGVE附加到NIV驱动程序上，我们可保证管 理程序层安全。2014 Check Point Software Technologies Ltd.20示例：从物理到虚拟化 VSX互联网2014 Check Point Software Technologies Ltd.21Check Point VSX最多可将250个网关合并成1台设备每个

15、用户、群或添加虚拟系统，无需购买更多硬件VSX2014 Check Point Software Technologies Ltd.22Check Point VSXFirewallIPSApplication ControlIdentityAwarenessURL FilteringAntivirusAnti-BotVSX所支持的软件刀片全系列平台支持 and Open Servers全功能软刀片 on 每一个虚拟系统2014 Check Point Software Technologies Ltd.23Check Point 云安全 远程访问IPS-AV-AS-MobileMABVMWa

16、re ESXSGVECheck Point 61000 Check Point VSX服务器区Co部rp门AnetExt部r门aCneD部M门BZt管理员客户区的物理每个部门/数据中心公司网络2014 Check Point Software Technologies Ltd.2461000 Appliance吞吐200 Gbps并发连接70 Million每秒新建600,000 cps61000 Security System可扩展至12个刀片专为高可用性打造的全冗余ATCA架构独立的网络接口模块IPS吞吐110 Gbps2014 Check Point Software Technolog

17、ies Ltd.25全冗余刀片架构-61000稳健的负载分担虚拟系统的数据流在各个刀片之间自动负载均衡扩展简单只需插入更多刀片即可带来更高性能2014 Check Point Software Technologies Ltd.26定制化安全 FWIAVPNADNCAVIPSAPCLURLFMOBAB为不同用户定制化不同的安全策略Any Software Blade(s) with Any security policy on Any Virtual SystemIPSVPNIPSAVAnti-BotIAAPCLURLFAV2014 Check Point Software Technolog

18、ies Ltd.27简化虚拟系统的实施和管理 ONE Gateway一键式虚拟系统创建一目了然的可视化向导和服务开通模版每个虚拟系统具备单独的安全策略可定制的安全功能以及精细化的独立安全策略控制WebSecurity with Virtual SystemsHRFinancePartnersCustomers操作简单 每系立的资源监控 虚拟系统之间的数据通过虚拟路由器和交换机进行重定向 软件升级无需宕机2014 Check Point Software Technologies Ltd.28Check Point提供全方位的安全粒度控制 反垃圾邮件和电子邮件安全反病毒和反恶意软件IPS高粒度可

19、见SmartEvent性2014 Check Point Software Technologies Ltd.29SmartDomain Manager 多租户管理 将您的安全管理环境分割为多个小型的虚拟安全域Check Point SmartDomainPerimeter firewallsCorporate branchesInternal firewallsDMZfirewallsData center firewalls2014 Check Point Software Technologies Ltd.30SmartDomain Manager 多租户管理 将您的安全管理环境分割为多

20、个小型的虚拟安全域Check Point SmartDomainPerimeter firewallsCorporate branchesInternal firewallsDMZfirewallsData center firewalls2014 Check Point Software Technologies Ltd.31为每个虚拟安全域定义不同的管理员SmartDomain Manager 分权分区管理 将您的安全管理工作分割到不同的虚拟安全域集中管理虚拟安全域2014 Check Point Software Technologies Ltd.32基于角色的管理和审计 把安全管理的责

21、任和授权赋予适合的管理人员2014 Check Point Software Technologies Ltd.33多级安全策略管理 允许”用户”制定不同的安全策略以符合该”用 户”的安全需求MDGMDS 三个层次的策略管理 全局策略 节点（Site）级策略 设备级策略 Site ASite BSite C2014 Check Point Software Technologies Ltd.34分布式日志管理 MDSNOC可扩展的冗余日志架构数据中心 AMDGCLMv Multi-Domain Log Module 提高日志性能v Customer Log Module 本地日志管理v 自动日志归档v 冗余日志管理架构v 多点日志传送v 日志传送重定向数据中心 BMLMCLM2014 Check Point Software Technologies Ltd.35集成的管理高可用性架构 确保不间断的安全策略管