seven pillars of ip mpls security

OVERVIEW The Seven Pillars of MPLS Security Helping Protect Your Network As networking evolves to meet sophisticated communications needs, enhanced application performance becomes a strategic priority The Network is a Frontline Security Device ’s security starts within its Global Network, and extends to customers and their applications. According to Ed Amoroso, ’s for most enterprises. To support the complexity associated with changing application requirements, many businesses are responding Chief Security Officer, “’s network is a major component in the security model that customers are building for their businesses.” by converging multiple networks onto a single IP/MPLS network. By providing voice, data and video on the same network, IP ’s security architecture includes: maximizes network infrastructure investments, simplifies control and administration and facilitates the management of multiple applications. •Secure connectivity Security needs to meet the demands of this new environment. •Perimeter security According to Tom Siracusa, Director of VPN Strategy at Labs, “In a converged environment, the complexity of the network tends to grow •Intrusion management exponentially. Complexity means added security must be put in place to manage that environment effectively. Security in the network is •Identity management critical and should be the first line of defense from security breaches.” •Policy management •Monitoring and management Staying Ahead of the Hackers Viruses have moved from an occasional nuisance to a critical daily concern for companies everywhere. Hackers create more than 300- •Incident management 400 new viruses and worms every month that are becoming more sophisticated and resistant to anti-virus software. Sensitive data in the Security addresses routers, firewalls and gateways, as well as systems, applications and data. network may be exposed to outside intruders, particularly as alternative access methods like wireless continue to grow. To protect customer networks and services, uses a “defense in depth” security architecture, with security built into every network Keeping a corporate network secure is more than just installing firewall technologies and applying patches. Security in a converged layer and every supporting process. The goal of “defense in depth” is that if the security fails at the first layer, the second layer has more environment is multi-faceted. It should address all infrastructure layers, including physical transport, the network and applications. security with which the intruder must contend. Thus, it can be difficult topenetrate because there are many layers of security built into every To be effective, security measures must be end-to-end, extending from the network to the customer application. system, process and piece of the network architecture. No single layer of security can guard against information theft, corruption, disclosure Some providers suggest that simply isolating corporate networks from the Internet can guarantee security. However, avoiding the Internet to and denial of service. Unique security services at each layer are needed to provide enhanced protection – preventing unauthorized prevent security issues can undermine the basic effectiveness and productivity of business operations. Systems can be protected using a access and attempting to detect, respond and mitigate the damage if access is achieved. combination of a secure, MPLS-enabled network and a comprehensive security plan that crosses all networking layers. The Best Defense? Using Real-Time Data to Prevent Attacks MPLS adds significant reliability and performance capabilities, enabling applications to perform and scale as business needs change. is “The best defense companies have is to formulate proactive plans, advanced networking and security solutions. This strategy can assess regarded as one of the MPLS industry’s leaders based on our early and continuing work with the technology, and continues to pioneer its use risk and eradicate attacks that are brewing long before they penetrate the network,” states Amoroso. takes a preventative approach by offering a suite of virtual private networks (VPNs) that are enabled by MPLS. to security to identify, detect and manage potential intrusions before they inflict damage. collects, analyzes and interprets net flow data to enable threat identification and response. Traffic anomalies are detected and cyber attacks can be predicted in the early stages. The combined force of MPLS in conjunction with ’s multilayered security protection ensures that businesses can utilize a secure network that is flexible and scalable for future applications. This advance notice enables to contain and minimize damage inflicted by an attack. Alerts can be provided for threats impacting the IP Network, for threats entering a customer’s private network and for threats within a customers private network. Seven Pillars of MPLS Security Secure Customer Applications on the Global Network MPLS Backbone has evolved its IP networks to a single, global, Multi-Protocol Label Switching (MPLS) enabled backbone deployed over an intelligent Separation Automation Monitoring Control Testing Response Innovation optical core network. MPLS, an industry standard, is the key technology that has enabled this network evolution. The next network evolution, riding on top of the MPLS backbone, will be made possible by the new IP Multimedia Subsystems (IMS) architecture. With IMS at the core of ’s new multimedia architecture, businesses will be able to partake of new and innovative services that will enhance productivity, such as seamless mobility between any possible type of Does Your Provider Follow the Seven Pillars? communications device. The result? can support businesses’ migration to a converged environment with a range of networking As IP networks are embedded in the critical processing of applications, it is essential to help ensure superior levels of carrier-grade security. solutions to meet their needs. With the integration of MPLS, has developed a set of seven basic security protection methods, or “pillars.” These pillars maintain a Applications such as Voice over IP (VoIP) and Enterprise Resource Planning (ERP) are designed to solve specific networking problems constant security focus in all design, deployment and operational processes surrounding our MPLS core network infrastructure. Does faced by customers. These applications demand networking flexibility, quality of service and often require capabilities beyond those found your provider follow the principles of the Seven Pillars? ’s seven pillars of MPLS security include: on a private network. How can businesses satisfy the networking requirements of these applications while minimizing security risks? 1. Separation Customer traffic is separated using MPLS Virtual Private Networks, assuring data packets cannot leak from or to another customer’s VPN or other data traffic on the backbone. MPLS Facts •MPLS separates the traffic of one business’s VPN from •Containment: Traffic between customer-edge (CE) routers stays inside that customer’s VPN. No spill over can occur another’s, avoiding potential security breaches from unauthorized viewing and access •Isolation: No customer’s VPN can in any way materially impact or influence the content or privacy of another customer’s VPN •MPLS enables Class of Service (CoS) to prioritize network applications, eliminating the need to overprovision for expected network utilization •Availability: Denial of service activities injected from a CE router will only impact that customer’s VPN services •MPLS enables network scalability to accommodate new applications and technology standards •Simplicity: Through development, investment and innovation, has automated provisioning, resulting in improved security by reducing potential configuration mistakes. MPLS also provides •MPLS in the “core” network infrastructure enables scalable provider architectures that enable growth, while reducing router configuration changes. These changes can potentially enhanced restoration, providing better performance for applications disrupt customers Toprovide the highest level of security, most VPN customers are connected to physically separate provider-edge devices from Internetcustomers. This architecture provides: •Analysis: The world-class statisticians from designed and implemented specialized algorithms for security anomaly detection in large networks, and continue to fine-tune them to prevent new threats •VPN route uniqueness and segregation through the use of route distinguisher, virtual routing and forwarding tables, and route targets 4. Control enforces strict operational security controls in its MPLS core. •VPN traffic segregation •Automated provisioning systems that control VPN membership •Processes: ’s operations follow mature Methods and Procedures (M&Ps) that are derived from decades of best practices in operating customer networks The network core is shared across the services, with reliability achieved using: •A Label Switched Core: Internet and VPN traffic is Label switched across the backbone •Certification: ’s operations are certified to the best industry standards, wherever appropriate, and are compliant with the National Reliability Industry Consortium (NRIC) certification requirements •Control Plane Protection: No backbone routers visible to outside or reachable from external endpoint •Root Cause Analysis: All incidents are subject to comprehensive Root Cause Analysis steps to help ensure process improvements in case of any operational policy violations •Data Plane Protection: VPN and Internet traffic are kept in separate label switched paths so traffic can be differentiated in the core – keeping VPN capacity protected if an Internet incident occurs 5. Testing helps to ensure security compliance with testing, audits and reviews. 2. Automation Automated perimeter security tools protect ’s MPLS core, helping to ensure that customer-edge (CE) to provider-edge (PE) routes are properly managed and represented. •Testing: Experts are constantly performing intrusion detection, audits and penetration testing against server complexities for network management, customer care and service support •Filtering: uses automated provisioning and management of its access control lists (ACLs) on all provider-edge (PE) routers – Because customer MPLS VPNs are configured by an automated provisioning system, changes or discrepancies in router configuration are detected by regular exception reports •Least Privilege: Infrastructure routers, and PE interfaces, are hardened by turning-off, or severely restricting unnecessary protocols and ports •Auditing: Ongoing independent audits are used to confirm compliance with the Security Policy Requirements TACACS+ Authentication for authorized technicians: TACACS+ (Terminal Access Controller Access Control System), a mechanism for •Reviews: All processes have embedded controls that require expert security reviews ensuring access control and authentication to any device, is used to time-out, limit and lock out users after multiple access attempts. All access to network elements is controlled by a TACACS+ authentication system, with a strict hierarchy enforced of which 6. Response ’s security specialists’ rapid response mitigates risk. technicians are allowed access to what commands. All changes are logged on secure, high-capacity log servers to help ensure security •Tiered Response: Incidents are dealt with via a mature tiered response infrastructure that includes senior security and operations experts and accountability. 3. Monitoring IP traffic net flow monitoring provides early warning of Internet viruses and worms. A critical component of managing large-scale network •Proactive Indicators: The Computer Security Incident Response Team (A-CSIRT) acts routinely in a proactive manner on indicators that typically precede any customer-visible problems traffic is the capture, monitoring, and analysis of traffic flow data to detect trends and anomalies, such as worms and viruses. This monitoring provides unique protection benefits for the MPLS network in two ways: (1) allowing security teams to take steps toward •Innovative Customer Notification Service: has extended this capability to customers through a novel notification service to extend the 24x7 knowledge to customer-specific environments appropriate filtering, and (2) reducing risk in the core by using the monitoring system to detect any probes aimed at MPLS core – offers a suite of services available through Internet Protect® where real-time indicators of anomalous behavior or detected security events both inside and outside of the private address space. •External Access: also monitors any external access to its core address space from the Internet on a 24x7 basis network can be provided to clients on a 24/7 basis 7. Innovation funds extensive MPLS security research and is heavily involved in industry standards bodies where MPLS innovations are taking place. Glossary Route Distinguisher – Qualifies a VPN’s IPV4 routes Virtual Routing and Forwarding Tables – tables in which routes are stored •Security is a key focus area of ’s research laboratory, which finds new techniques for protecting customer traffic and systems • remains committed to networking, security and MPLS research Route Targets – Used to control iBGP distribution of a VPN’s routes to its virtual routing and forwarding tables Trust Your Security to “ has a long legacy of security,” states Amoroso. “We have the necessity to protect our own core IP backbone for customers, and have taken that capability and developed it into core products. Products that really answer the need to address a defense in depth architecture, all the way from the information level to the network level.” offers a complete range of security, availability and recovery services that provide businesses with integrated business continuity solutions to support complex networking requirements. For more information visit ’s Networking Exchange, at
In cities, towns and remote locations, mini satellite dishes point attentively to the Southern sky. Emblazoned with names like DirecTv, ExpressVu, DirecWay, Web Conferencing, iNetVu, Linkstar, XM Satellite Radio, Sirius Satellite Radio iDirect their numbers are growing at an amazing rate. Iridium Satellite Phone is the only provider of truly global satellite voice and data solutions with complete coverage of the earth (including oceans, airways and Polar Regions). Get the latest buzz on Free satellite tv systems - including the features and benefits that make them today's ultimate television viewing experience.(Get Dish) Ever wonder why these satellite dish systems are in such great demand? Does high speed internet service or digital television programming via satellite intrigue you?
If you've never heard of Cheap VoIP, get ready to change the way you think about long-distance phone calls. VoIP, or Voice over Internet Protocol, is a method for taking analog audio signals and turning them into digital data (IP packets) that can be transmitted over the Internet.