Intent Based Networking: turning intentions into reality with network security policy management
- 1. Intent Based Networking - Turning Intentions Into Reality With Security Policy Management Edy Almer, VP Product
- 2. WELCOME Have a question? Submit it via the chat This webinar is being recorded! Slides and recording will be sent to you after the webinar 2
- 4. WHAT IS IT – ANDREW LERNER@GARTNER • Isn’t Intent Based Networking just a fancy term for SDN ? • No, although the early usage and value will seem similar. Advanced automation solutions typically do not: a) Translate what to how b) Validate that desired intent is being met c) Continuously ingest a broad set of real-time network state indicators • A good intent-based networking system will embed advanced automation, but you can (and many do) advanced automation without Intent.
- 5. WHAT IS IT – SANJIT GANGULI @GARTNER
- 6. WHAT IS IT – SANJIT GANGULI@GARTNER • Translation and Validation — The system takes a higher-level business policy ( what ) as input from end users and converts it to the necessary network configuration ( how ). The system then generates and validates the resulting design and configuration for correctness. • Automated Implementation — The system can configure the appropriate network changes ( how ) across existing network infrastructure. This is typically done via network automation and/or network orchestration. • Awareness of Network State — The system ingests real-time network status for systems under its administrative control, and is protocol- and transport- agnostic. • Assurance and Dynamic Optimization/Remediation — The system continuously validates (in real time) that the original business intent of the system is being met, and can take corrective actions (such as blocking traffic, modifying network capacity or notifying) when desired intent is not met.
- 7. ARE YOU DEPLOYING INTENT BASED NETWORKING? • Yes – Cisco Tetration, Cisco ACI • Yes – Juniper • No – its just marketing fluff • Yes – other. Please let us know which in questions tab Please vote using the “votes from audience” tab in your BrightTALK panel
- 8. WHAT ARE MY OPTIONS TODAY ? 1. Technically automate heterogenous networks, without intent and without understanding – Orchestration systems (Chef, Ansible) and dedicated systems 2. Declare intent, but have very limited automation capabilities – anybody trailing (poll) 3. Describe application, and automate operations, but for single type of infrastructure – VMware NSX, Cisco ACI 8 | Confidential
- 10. 10 | Confidential AlgoSec enables companies to align security with their business processes Business-driven Agility Business-driven Visibility Business-driven Security BUSINESS DRIVEN SECURITY MANAGEMENT
- 11. Business-Driven Security Business-Driven Agility Business-Driven Network Security Policy Management Unified Visibility Across Cloud, SDN & On-Premise Enterprise Networks Auditing & Compliance Risk Management Business Continuity Digital Transformation Change Management Incident Response DevSecOpsMicro- Segmentation BUSINESS-DRIVEN SECURITY MANAGEMENT USE CASES
- 12. THE ALGOSEC SECURITY MANAGEMENT SOLUTION 12 | Confidential
- 13. ALGOSEC FOR INTENT BASED NETWORKING • (ABF) Translation and Validation — The system takes a higher-level business policy ( what ) as input from end users and converts it to the necessary network configuration ( how ). The system then generates and validates the resulting design and configuration for correctness. • (AFF) Automated Implementation — The system can configure the appropriate network changes ( how ) across existing network infrastructure. This is typically done via network automation and/or network orchestration. • (AFA) Awareness of Network State — The system ingests real-time network status for systems under its administrative control, and is protocol- and transport-agnostic. • (Additional Analytics + RT connectivity check) Assurance and Dynamic Optimization/Remediation — The system continuously validates (in real time) that the original business intent of the system is being met, and can take corrective actions (such as blocking traffic, modifying network capacity or notifying) when desired intent is not met. 13 | Confidential
- 14. ALGOSEC FOR INTENT BASED NETWORKING • (ABF) Translation and Validation — The system takes a higher-level business policy ( what ) as input from end users and converts it to the necessary network configuration ( how ). The system then generates and validates the resulting design and configuration for correctness. • (AFF) Automated Implementation — The system can configure the appropriate network changes ( how ) across existing network infrastructure. This is typically done via network automation and/or network orchestration. • (AFA) Awareness of Network State — The system ingests real-time network status for systems under its administrative control, and is protocol- and transport-agnostic. • (Additional Analytics + RT connectivity check) Assurance and Dynamic Optimization/Remediation — The system continuously validates (in real time) that the original business intent of the system is being met, and can take corrective actions (such as blocking traffic, modifying network capacity or notifying) when desired intent is not met. 14 | Confidential
- 15. Discover, provision, maintain and securely decommission network connectivity for critical business applications. 15 | Confidential APPLICATION CONNECTIVITY MANAGEMENT Automated discovery and mapping of business connectivity Translation of business requirements in to networking terms Secure application decommissioning Business-centric risk analysis Impact assessment to avoid outages Rapid datacenter and cloud migration
- 16. ALGOSEC FOR INTENT BASED NETWORKING • (ABF) Translation and Validation — The system takes a higher-level business policy ( what ) as input from end users and converts it to the necessary network configuration ( how ). The system then generates and validates the resulting design and configuration for correctness. • (AFF) Automated Implementation — The system can configure the appropriate network changes ( how ) across existing network infrastructure. This is typically done via network automation and/or network orchestration. • (AFA) Awareness of Network State — The system ingests real-time network status for systems under its administrative control, and is protocol- and transport-agnostic. • (Additional Analytics + RT connectivity check) Assurance and Dynamic Optimization/Remediation — The system continuously validates (in real time) that the original business intent of the system is being met, and can take corrective actions (such as blocking traffic, modifying network capacity or notifying) when desired intent is not met. 16 | Confidential
- 17. Process firewall changes with zero- touch automation. 17 | Confidential SECURITY POLICY CHANGE AUTOMATION Security policy workflow automation Topology analysis and optimal rule design SLA tracking and complete audit trail Integration with ticketing systems Change validation and reconciliation Proactive risk and compliance verification Automated policy push
- 18. ALGOSEC FOR INTENT BASED NETWORKING • (ABF) Translation and Validation — The system takes a higher-level business policy ( what ) as input from end users and converts it to the necessary network configuration ( how ). The system then generates and validates the resulting design and configuration for correctness. • (AFF) Automated Implementation — The system can configure the appropriate network changes ( how ) across existing network infrastructure. This is typically done via network automation and/or network orchestration. • (AFA) Awareness of Network State — The system ingests real-time network status for systems under its administrative control, and is protocol- and transport-agnostic. • (Additional Analytics + RT connectivity check) Assurance and Dynamic Optimization/Remediation — The system continuously validates (in real time) that the original business intent of the system is being met, and can take corrective actions (such as blocking traffic, modifying network capacity or notifying) when desired intent is not met. 18 | Confidential
- 19. 19 | Confidential NETWORK ABSTRACTION & POLICY ANALYSIS Topology map and traffic simulation Firewall rule optimization and cleanup Network segmentation enforcement Baseline configuration compliance Audit-ready compliance reports Risk assessment Visibility and analysis of complex network security policies across on premise and cloud networks.
- 20. GENERATE AND PUSH WHITELIST POLICIES: CISCO TETRATION/ACI/ASA/IOS/FTD • Cisco Tetration Analytics generates whitelist policy recommendations and enforces host based polices • AlgoSec configures security policies to multi-vendor security devices and SDN controllers (automatically/with modifications) ACI
- 21. ALGOBOT: HELPS USERS VERIFY INTENT IS MET 21 | Confidential
- 40. SUMMARY • Intent-Based Networking is an exciting advancement in Networking • Application owners can express intent and receive a continuously maintained active path • Algosec implements intent-based networking today!
- 42. UPCOMING WEBINARS https://www.algosec.com/webinars Topic: Agility vs. Control: The Security Policy Management Balancing Act When: Tuesday, May 15 Presented by: Anner Kushnir, VP Technologies Topic: Best Practices to Manage Security Across a Software Defined Network When: Tuesday, May 22 Presented by: Omer Ganot, Director of Product Management ---Sign up now ---
- 43. AlgoSummit World Tour 2018 AlgoSummit EMEA 2018 The premier event for AlgoSec customers and channel partners Barcelona, May 4-7, 2018 For more info: https://www.algosec.com/algosummit/
- 44. BE OUR FRIEND Follow us for the latest on security policy management trends, tips & tricks, thought leadership, fun stuff and prizes, and much more! And subscribe to our YouTube channel for a wide range of educational videos presented by Prof. Wool www.linkedin.com/company/algosec www.facebook.com/AlgoSec www.youtube.com/user/AlgoSec www.twitter.com/algosec blog.algosec.com
- 45. Thank You