思科网络准入控制管理.ppt

1、思科网络准入控制管理,Network Access Control (NAC),安全趋势与网络准入控制 思科网络准入控制管理简介 思科网络准入控制功能介绍 思科网络准入控制部署和应用,议程,全球电子犯罪率上升迅速！,Malicious Software Strains exploded from 30K/40K per month to 170,000 from February to March 2008 Phishing e-mails doubled 400,000 a day in August to nearly 800,000 a day in November) Ads for

2、stolen identity information doubled or tripled in price in Fall 2008 (stolen identity that once cost $5, for instance, now sells for $15). Over 100 million credit/debit card transactions compromised due to malware at a large US Payment Processor possibly the largest data breach to date (WashingtonP

3、- Jan 20, 2009),Theres been a marked increase in the number of attacks and the number of successful fraud attemptsThis is the busiest practice has ever been.” Gartner 2008,“In periods of recession or slow growth, companies are going to turn their attentions to customer retention rather than customer

4、 acquisitionThe last thing you need in that environment is a data breach and the associated brand damage.“ Forrester 2008,企业重要数据泄漏统计,Unauthorized application use: 70% of IT say the use of unauthorized programs result in as many as half of data loss incidents. Misuse of corporate computers: 44% of em

5、ployees share work devices with others without supervision. Unauthorized access: 39% of IT said they have dealt with an employee accessing unauthorized parts of a companys network or facility. Remote worker security: 46% of employees to transfer files between work and personal computers. Misuse of p

6、asswords: 18% of employees share passwords with co-workers. That rate jumps to 25 percent in China, India, and Italy.,终端应用安全现状,终端遭受严重安全威胁，各种恶意代码攻击，如病毒、蠕虫、木马及混合安全威胁，非法访问，黑客攻击,如何防范？,网络准入控制的好处,Source: Infonetics Research, May 2008,网络准入控制实例统计,安全趋势与网络准入控制 思科网络准入控制管理简介 思科网络准入控制功能介绍 思科网络准入控制部署和应用,议程,思科网络准入

7、控制NAC领先、创新！,4000+ customers,41% market share1,1 Infonetics, June 2008 2 Frost 能判断接入网络的设备是否安装了要求的操作系统补丁; 能判断接入网络的设备是否安装并运行了认可的防病毒软件及其病毒库是否为最新; 能够结合域帐号对接入网络的设备的身份进行验证; 可针对上述14的判断结果对交换机的端口进行切换控制,并将端口划分至策略定义的VLAN中; 系统应可同时控制局域网接入用户和VPN连接接入用户;,NAC项目网络拓扑VPN部分,NAC实施经验,NAC实施前准备 NAC的需求要细化 用户分类，制定访问控制策略 调查终端用户技术水平 掌握网络基础条件 NAC实施注意事项 先小规模