Abra售前-技術(shù)版課件

ManojGuptaFebruary23,2010CheckPointAbra

TechnicalPresentation

PutyourofficeinyourpocketAgenda1Introduction

2Architecture3FeatureFocus4Installation5ConfigurationandManagement6Summary

IntroducingCheckPointAbra

CheckPointAbraPutyourofficeinyourpocketVirtualworkspacethatkeepsmobiledatasecureIdealformobileworkers,contractorsanddisasterrecoveryInstantlyturnanyPCintoyourowncorporatedesktopWhyAbra?WhoNeedsAbra?Why?BlockmaliciouscodefromunknownPCsEveryuser

Mobile.Remote.Home.ContractorsUnmanagedPCsDisasterrecoverySustainproductivityUnsecureconnectionsDatalossComplianceissueswithunmanagedPCsSecurelyaccessandworkwithcorporatedatafromanyPCVirtualWindowsworkspacePlug-and-playwithnosoftwareinstallorsystemrebootrequiredTurnAnyPCIntoYourOwn

CorporateDesktopAbraComponentsCheckPointAbrawithSanDiskenterprisegradeUSBdriveSecureconnectivitythroughCheckPointSecurityGatewaysAbrapolicyconfigurationusingCheckPointNetworkPolicyManagementSoftwareBladeAgenda1Introduction

2Architecture3FeatureFocus4Installation5ConfigurationandManagement6Summary

Abra–VirtualizationEngineSystemComponentSecureWorkspaceComponentDefaultUserAccount:Inmostcases(especiallyinWindowsXP)applicationsrunwithadminrightsandifthehostOSisinfectedtheuserfileswillalsobeinfectedNon-VirtualizedWorkspaceAllchangesaffectthereallocal-systemSecureWorkspaceVirtualizationEngineVirtualfilesystem,virtualregistryWindowssystemDLLstoaccessfilesystem,registry,UI,NTDLL.DLL,USER32.DLLOperatingSystemandkerneldriversKernelUserSpaceEncrypted&VirtualizedEncrypting&VirtualizingAbraTopologyAbraCheckPointSecurityGatewaysHostComputerSmartCenterManagementSecureWorkspaceVPNconnectionAbraissupportedonVPNSoftwareBlade:R65:HFA60andEVE2R70.20(HFA20)ConnectivityflowAbraestablishesSSLVPNtunnelbasedonuserauthenticationSecurityGatewaydeliversAbrapolicyandupdatesoverSSLVPNtunneltotheclientUsertrafficpassesoverSSLVPNtunnel.TheSecurityGatewaydecryptsandforwardsitintocorporatenetworkSSLVPNtunnel(2)Updates(3)Policydelivery(4)UsertrafficCheckPointSecurityGatewaysSecureWorkspaceSecuritythroughSegregationAbraFilesandFoldershavealwaysonHWandSWEncryptionNoresidueisleftontheRAMPCfoldersarenotaccessiblefromAbraPrintingisblockedSwitchingenvironmentsbetweenAbra&PCEncryptedandSegregatedClipboardAbrafoldersarenotaccessiblefromthePCAbrainnon-CPenvironmentTarget:non-CPcustomersNoCPVPNgatewayUsing3rdpartySSLVPNsolutionforRemoteAccessManagedbythestandaloneCPPolicytoolPolicyandupdatesdeliveredthroughacorporateWebserverConnectstothe3rdpartySSLVPNPasswordresetsupportAbraStand-AloneDeploymentAbrainnon-CPenvironmentAbra3rdpartySSLVPNvendorHostPCWebserver(AbrapolicyandCAB)SecureWorkspaceVPNconnectionHTTPISWandICSpolicyupdatesAgenda1Introduction

2Architecture3FeatureFocus4Installation5ConfigurationandManagement6Summary

AbraAuthenticationEnforcedStrongPasswordPolicyMandatoryDeviceAuthenticationAbraSecureRemoteAccessAdvancedVPNclientwithauto-connectcapabilitiesSSLencryptionMax500concurrentconnectionsLocationawarenessAlwaysconnectedRoutealltrafficHotspotdetectionandregistrationAccessfilesandapplicationsanywhere,withintegratedVPNAbraProgramControlProgramcontrol(PA)–AllowexecutionofauthorizedapplicationsasdefinedinthepolicyAllowallapplicationsandActiveXcontrolsAllowallexceptPAblacklistAllowbyexenameandmatchingMD5BlockexecutionofunauthorizedprogramsBlockExecutionofUnauthorizedApplicationsAbraFileImport/ExportProvidecontrolleddatatransferbetweenAbraandhostPCPreventdataleakfromAbraSWtothehostsystemPreventFiletransferfromunmanaged/unsecuredhosttoAbraSWControlledbyAbrapolicyUsage:Import:Copy/movefilesfromhostPCtoAbraExport:Copy/movefilesfromAbratothehostPC(ifallowedbyAbrapolicy)

ProtectAgainstDataLossAbraonSanDiskUSBdriveAllfilesstoredsecurelyonencrypted SanDiskUSBdriveAES256bithardwareencryptionAnti-bruteforceprotectionUltrafasttransferspeed20MbpsWrite/25MbpsReadPlug-and-PlaystartupCertifiedFIPS140-2Level2MgmtAgentSecure

FlashSecure

CDCryptographic

Chip

Cryptographic

ChipSecure

FlashSecure

CDMgmtAgentCompliancewithHighestLevelofDataSecurityPasswordResetPasswordtoolinstalledonthesameserverasNetworkPolicyManagementserverThetoolislocatedinSmartDashboardfolder:C:\ProgramFiles\CheckPoint\SmartConsole\...\AbraDashboard.exePasswordmanagementforIThelpdeskpersonnelRemoteHelpForForgottenPasswordAgenda1Introduction

2Architecture3FeatureFocus4Installation5ConfigurationandManagement6Summary

Abraclient-InstallationPre-bundledsolutiononSanDiskUSBdrivewithplug-n-playlightweightarchitectureAutomaticallyupdatesoverSSLtunnelUsersarenotifiedwhennewupdateisavailablePostinitializationprocess,usertocreateapasswordforAbradeviceandsetupVPNconnectivityNoSoftwareInstallationorPCRebootRequiredCheckPointAbra-SecureWorkspaceVPNClientSecuredApplicationsImportdirectoryImport/ExportbuttonDiskspaceandLocationnotificationStandardWindowsEnvironmentProcesseswhenAbraislaunchedSanDisk’sloginprocessSanDiskProcessthathidestheremovabledriveVPNClientprocessVPNGUISecureWorkspaceAgenda1Introduction

2Architecture3FeatureFocus4Installation5ConfigurationandManagement6Summary

AbrawithCheckPointVPNSoftwareBladeCustomerswithexistingCPinfrastructureAbraestablishesSSLtunnelwithCheckPointVPNsoftwarebladeAbrapolicyisconfiguredandmanagedthroughNetworkPolicyManagementSoftwareBladeAbraupdatesaredeliveredviaVPNtunnelSimpleSetupandAdministrationwithexistingManagementGatewaysidecomponentsR65R70StandaloneConfigurationR65.4HFA60Eve2HotfixR70.20DistributedConfigurationModuleHFA60Eve2HotfixR70.20ManagementR65.4HFA60Eve2hotfixR70.20SmartConsoleEve2R70.20

CentralManagement

VPNConnectivitysettingsAuthenticationrulesCentralPolicyConfigurationandUpdateConfigure&ManageAbrafromNetworkPolicyManagementSoftwareBladeAbraSecureWorkspacePolicyIsolatealluserfilesandpreventdatalossBlockmaliciouscodefromunauthorizedapplicationsKeepingMobileDataSecureControloutboundtraffictohelppreventdatalossAgenda