devnet-1124cisco pxgrid: a new architecture for security platform integration

DEVNET-1124

Cisco Platform Exchange Grid (pxGrid)

A new architecture for Security Platform Integration

Nancy Cam-WingetDistinguished Engineer

Brian GonsalvesProduct Manager

© 2015 Cisco and/or its affiliates. All rights reserved. Cisco PublicDEVNET-1010

Agenda

• Cisco pxGrid in Summary

• pxGrid Use-Cases

• How to Develop Using pxGrid

• Getting Started

pxGridSECURITY THRUINTEGRATION


WHY CUSTOMERS CARE

Cisco pxGrid – Context-Sharing & Network MitigationConnecting Partners & Cisco Security Platforms, Connecting Partners-to-Partners

Cisco Provides Network Context to Customer IT

Platforms

Use Eco-Partner Context for Cisco Network Policy

for Customers

Cisco Shares User/Device & Network Context with IT

Infrastructure

Cisco Receives Context from Eco-Partners to Make Better Network

Access Policy

1 2 3Help Customer IT

Environments Reach into the Cisco Network

CISCO PLATFORM ECO-PARTNER

CONTEXT

CISCO PLATFORM ECO-PARTNER

CONTEXT

ECO-PARTNER CISCO PLATFORM

CISCO NETWORK

ACTION

MITIGATE

Puts “Who, What Device, What Access” with Events. Way Better

than Just IP Addresses!

Creates a Single Place for Comprehensive Network Access

Policy thru Integration

Decreases Time, Effort and Cost to Responding to Security and

Network Events

©2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 5©2014 Cisco and/or its affiliates. All rights reserved. 5

“Sensitive Asset”

“Other Asset”

“Sensitive Asset”

87% of data breaches involve poor access rules…we need to do this better.Verizon Data Breach Report

Access Criteria: Who: User, Group

USE CASE: Context from Cisco Identity Services Engine (ISE) to Application Control System to Increase Application Security

©2014 Cisco and/or its affiliates. All rights reserved. Cisco Confidential 6©2014 Cisco and/or its affiliates. All rights reserved. 6

ACCESS POLICY – “Critical Data” WHO = Exec Group Only WHAT = No Non-

Registered Mobile WHERE = UK Only WHEN = UK Business

Hours Only HOW = No VPN Access

Vary this gent’s application access privilege based on device enrollment, geo-location and access method

“Financial Reports”

“Café Menus”

“HR Database”

ISE Context Completes the Picture – Granular Application Data Control

Access Criteria Non-Sensitive Sensitive Critical Data


I have identity & device!I need geo-location & MDM…

I have application info!I need location & device-type

I have location!I need app & identity…

Cisco ISE as pxGrid Controller

Publish Publish

Discover TopicDiscover Topic

Continuous FlowDirected QuerypxGrid

ContextSharing

Authorize

PublishDiscover Topic

Continuous Flow

Directed Query

CISCO ISE

Autho

rize

Authorize

Continuous FlowDirected Query

I have sec events!I need identity & device…

I have MDM info!I need location…

How pxGrid Works: Partners Connecting to Cisco Security Platforms…and to Other PartnersAuthenticate Authorize Publish Discover Subscribe Query


I have identity & device!I need geo-location & MDM…

I have application info!I need location & device-type

I have location!I need app & identity…

ISE as pxGrid Controller

Publish Publish

Discover TopicDiscover Topic

Continuous FlowDirected QuerypxGrid

ContextSharing

Authorize

PublishDiscover Topic

Continuous Flow

Directed Query

CISCO ISE

Autho

rize

Authorize

Continuous FlowDirected Query

I have sec events!I need identity & device…

I have MDM info!I need location…

How pxGrid Works: Partners Connecting to Cisco Security Platforms…and to Other PartnersAuthenticate Authorize Publish Discover Subscribe Query

Traditional APIs have many Limitations - pxGrid addresses these issues:

• Single-purpose function = need for many APIs/dev (and lots of testing)

• Not configurable = too much/little info for interface systems (scale issues)

• Pre-defined data exchange = wait until next release if you need a change

• Polling architecture = can’t scale beyond 1 or 2 system integrations

• Security can be “loose”


pxGrid Architecture & Components

pxGrid Controller

pxGrid Controller Responsible for Control Plane:• Establishing the “grid” instance• Authenticating clients on to the grid• Authorizing what clients can do on the grid• Maintaining directory of context information “topics”

available on the grid

pxGrid Client

pxGrid Clients (Eco-Partner Platforms) Responsible for:• Utilizing pxGrid Client Libraries (in SDK) to communicate with the

pxGrid Controller• If sharing contextual information, publishing it to a “topic”• If consuming contextual information, subscribing to appropriate “topic”• Filtering “topics” to exclude unwanted information• Ad-hoc query to “topics”

pxGrid Client


Example: Evolution from REST to pxGridCisco ISE User/Device Context-Sharing Example

Session Context sharing from ISE MnT Issues pxGrid Solution

Periodic polling using REST API Publish & Subscribe notification push

DB queries causing high I/O usage No DB query with published events caching

Bulk download takes more than 3 hours for 200,000 endpoints using REST API

• pxGrid provides XML streaming of sessions with pagination• Provides semantic filtering capability (ex: location) to download

only a subset

Receiving all attributes per session To only send interested attributes through syntactic filtering

Use of syslog as interim approach - All events are processed Pubsub notification - only relevant events will be sent

No visibility and mechanism to authorize, control who is accessing MnT

• pxGrid provides single point of authentication and authorization, allowing only authorized systems to access the MnT

• pxGrid provides visibility into topics, publishers, subscribers …

Other issues: • requires opening up firewall ports for reverse web services

calls• no support for federation• Lacks scale with endpoints increase

• XMPP protocol supports bi-directionality with tunneling• XMPP supports federation • pxGrid scaling and HA is achieved by leveraging XMPP server

architecture


Cisco pxGrid SDK Components & FunctionComponent Function

Grid Client Library (GCL) in C and Java • Software libraries for embedding in partner system• Connects partner system to the pxGrid

Sample pxGrid Data Output • Sample data from Cisco ISE across a pxGrid connection to test with

Sample Data Generator • Generates live session data across a pxGrid connection• Uses Cisco ISE user/device session data

pxGrid Controller Virtual Machine for Testing • ISO of bundled Cisco ISE and pxGrid Controller for local testing in your lab

Hosted Testing Sandbox • Enables developer to connect to an already setup test environment

pxGrid Documentation: Tutorials, Development Guides, testing guides,

• Complete documentation to guide the developer from concept to implementation to verification testing


A Closer Look at the pxGrid Connection Library…

• Connection to pxGrid Server• Multiple pxGrid servers• Round-robin auto retries• Reports connection status

• Client certificate based authentication• A root cert is installed in pxGrid server• pxGrid server verifies client certs are signed by the root cert

• Capability subscription and publishing• Capability is a set of queries and notifications supported• pxGrid provides discovery of Capability• Notifications are sent to XMPP pub/sub• Queries are directly sent to Capability provider


How to Get Only the Context You Need…pxGrid Message Filtering

• Allows subscriber to filter/restrict messages based on specified filter criteria.

• Two kinds of filters:• Content Based Filters

• Restrict messages based on the content of the message• e.g. an ASA device interested in receiving session information from ISE only for end

points belonging to a subnet• Schema Based Filter

• Allows clients to receive only a subset of attributes instead of the full message object• Not supported in this phase


How to Install and Test Using the pxGrid SDK

1. Install pxGrid Controller: Install Cisco ISE 1.3 ISO on a VM.

2. Setup pxGrid Controller/Client Key-stores and Trust-stores: Import samples certificates from SDK. These certificates will be used by the pxGrid client for mutual authentication to the pxGrid controller.

3. Enable pxGrid Controller: Enable pxGrid persona in Cisco ISE.

4. Setup pxGrid Test Client: Download SDK onto pxGrid client. This can be installing client libraries in your platform or hosting on an external test client (Linux box, e.g. CentOS).

5. Authenticate pxGrid Client: Import the ISE identity sample cert into your platform or the Linux client, and add to key store.

6. Test with SDK Scripts: Run pxGrid sample scripts included in the SDK


Using the pxGrid Client LibrariesDeveloper platforms interact with pxGrid by registering the appropriate query and notification callers and handlers as detailed below:

• Query Handler: A provider must register query handler with the pxGrid client library to service a query that it needs to expose over pxGrid.

• Query Caller: A query caller is created by assembling a request and calling the query method on the pxGrid connection.

• Notification Handler: Registers a notification handler with the pxGrid connection to receive notifications for a capability.

• Notifier: To be able to publish notifications, the developer platform must first invoke a publish capability method.


pxGrid Sample Scripts Currently Available in the SDK• Sample pxGrid scripts provide development partners with executable example

code for how to use the API

• These scripts can also be useful in demos with customers

• Most commonly used pxGrid API scripts on Cisco ISE:• Register: registers pxGrid client to the pxGrid controller to an authorized session or ANC/EPS group.• Session Subscribe: pxGrid client subscribes to capability• Identity Group download: Downloads user identity information such as the user and profiled group

information from active sessions in ISE• Session Query by IP: retrieves all active session from ISE based on IP address• Session Download: downloads all active sessions from ISE• ANC/EPS Quarantine: executes the Adaptive Network Control (ANC) quarantine action on ISE for a given

IP address• ANC/EPS Unquarantine: executes the ANC/EPS unquarantine action on ISE for a given IP address• Capability: queries the registered pxGrid client name for available topic provided by the publisher (ISE in

this case)


In Summary…and How to Get StartedCisco pxGrid Enables:

• Integration between development partners and the Cisco security products

• Many-to-many integration scalability

• The ability to integrate once to pxGrid and re-use that implementation to interface with any other pxGrid platform (even other Cisco development partners)

• Integrations with the Cisco Identity Services Engine (ISE) are available today

Get Started:

• Cisco Identity Services Engine (ISE) integrations available today

• Use user-to-IP address bindings answer “who” in your platforms

• Use device identification to answer “what type of device” in your platforms

• Use mitigation capabilities to take actions on users/device from your platform

• Access SDK, client libraries and tutorials at: https://developer.cisco.com/site/pxgrid/

https://developer.cisco.com/site/pxgrid/

https://developer.cisco.com/site/pxgrid/

Thank you


devnet-1124cisco pxgrid: a new architecture for security platform integration

Technology