Securing Your Live IP Production Workflow

Presenters : Ryan Morris - Arista

Year : 2019

dlp_document_download : C U R A T E D B Y I P S H O W C A S E T H E AT E R AT N A B – A P R I L 8 -11 , 2 01 9 Securing Your Live IP Production Workflows - Freeing Your Creativity Ryan Morris, Systems Engineer, Arista Networks rmorris@arista.com Network Security – Some Context • ST2110 is being rolled out for Live Production and Playout • Many are live sporting and UHD use -cases • This content and its delivery is highly valuable ‒ The content has value, it’s a piracy target ‒ The content drives viewing figures, and so revenue ‒ What is the advertising revenue from the S uperbowl worth?? • Both the content, and the production capability need to be safeguarded. 2 Network Security 3 First Question Is… WHAT IS SECURITY? IS IT ONLY ABOUT BLOCKING TRAFFIC? NO – BUT THAT’S PART OF IT! Network Security – Some Context 4 • Privacy – don’t let the wrong people get access • Make sure content is not altered • Data CAN be accessed through a system that is maintained Network Security – What Should I Do? • Injecting a bad source • What to do? 5 • Only Layer 3 interfaces? • What’s the downside? • Use DHCP for IP assignment? • Do all interfaces come up? • Start using 802.1x? • Everywhere, including remotes? Network Security – What is 802.1x? 6 Authentication Server (Radius) Authenticator CLIENT • Switch starts message exchange when interface has status page or when port receives a packet with an unknown source frame • An authenticator starts the negotiation by sending an EAP - Request/Identity packet. A supplicant starts the negotiation with an EAPOL -Start packet, to which the authenticator answers with a EAP -Request/Identity packet. • The supplicant answers with an EAP -Response/Identity packet to the authentication server via the authenticator. • The authentication server responds with an EAP -Request packet to the supplicant via the authenticator. • The supplicant responds with an EAP -Response. • The authentication server transmits either an EAP -Success packet or EAP -Reject packet to the supplicant. • If an EAP -Reject is received, the supplicant will receive an EAP - Reject message and their traffic will not be forwarded. Network Security – Bandwidth Mappings? • Broadcast Vendors want to secure YOUR multicast traffic…. • Restrict the bandwidth of every multicast stream – that’s a lot in 2110 • Stitch together the routes – don’t rely on hashing with multiple links 7 Data N/W Control N/W • Do even more… use policers on ingress! Network Security – How to talk to the network? 8 • The management plane should be well secured ‒ Enforce strong passwords and individual accounts for switch users ‒ Ensure users access rights are limited to functionality that they need ‒ Enforce minimum of SSH or stronger - valid certificates, Tacacs , or Radius authentication • Ensure all API's are encrypted (HTTPS) • SNMP should be read -only unless otherwise specified • Unused protocols should be excluded (control plane ACL's) Network Security – Who is allowed where? 9 • Only some IP addresses can make it through the network? • Restrict based on source IP and MAC • Forbid certain multicast groups from entering the system USE AN ACCESS CONTROL LIST "do not allow 237.0.0.0/16 to leave SW1 on interface 3/51" PTP Security • PTPv2 does not provide a whole lot of security • PTPv2.1 will add some security, and be backwards compatible • Many PTP end points are capable of adopting the role of master • The ability to configure a BC port as "Master only" is really useful! 10 PTP Security 11 Grandmaster A Grandmaster B M S S M S M S M S S M M S M Master S Slave ‘ptp role master’ IP ACL – secure network ‘ptp management messages’ PTP Telemetry 12 • Security is not just about restrictions • It’s also about data collection to be a few steps ahead • Stream data, counters, anything you need… • Producing data is one thing – being able to access it is another! PTP Telemetry 13 You will be amazed at what data you can tap into! • Performance of multiple BC’s • Skew across each BC • Verify all BCs locked to same GM • See trends within fine grain data • Counters… and write scripts to trigger an event IF counters are skyrocketing Network Security in Standards • As an indicator of where we are in the Security Journey, take a look at the EBU’s Technology Pyramid … • It’s identified in phase 5 • We can do more … 14 Conclusions • Security is vital - it’s not an after thought, and needs to be built in from the start. • Decide how much you need, and how you can achieve your workflow objectives, while remaining secure! • Like all objectives, security also needs to be measured – build a system that is both secure, and provides monitoring and telemetry that allows positive verification of that security 15 C U R A T E D B Y I P S H O W C A S E T H E AT E R AT N A B – A P R I L 8 -11 , 2 01 9 Thank You Ryan Morris, Systems Engineer, Arista Networks rmorris@arista.com, 1 -416 -819 -5391