| Hillstone Network Optimization Solution for Financial Industry |
| |
| |
|
|
| |
|
| 二、Countermeasures and Suggestions for Financial Network Security Problems |
Security Protection for Office Network
The office system is for office automation of internal users. OA system connects internal users through the LAN and enables users in different department to share resources as well as exchange information via the office network. Hillstone series security appliance deployed in the bank office network offers:
- High-performance firewall with network layer attack prevention
- Provide link load balancing and policy-based routing
- Bandwidth management of dynamic port applications such as P2P, IM, Internet video, etc.
- Bandwidth management and session control based on IP address
- High-performance virus detection and filtering
- Authentication based on Web redirection and L2TP
- Network visiting log record and network behavior auditing, including websites category database of URL filter, BBS posting record, email sending recode, and access control based on key words
- The third-generation SSL VPN
- Load balancing and various security checking technologies
- Provide security mechanism under IPv6
Security Protection for Banking Business
There are many kinds of banking business, for example credit card service, IC cards, personal and commercial banking, etc. It is vital to fully protect the network security of banking business. Hillstone series security appliance provides:
- DoS/DDoS and SYN protection
- Application layer intrusion prevention system (IPS), inspect and defend against over 3,000 attacks
- ARP attack defense.
- Session control and session rampup per second to protect back-end server
- Load balance and various security checking technologies
- DNS proxy and recursive DNS query control
- Support IPSec VPN
- Record and audit of network connection log
- Record and statistics of traffic log
Security Protection for Backbone Network
The bank network in China is an internal business system with three-class network architecture from headquarters to provincial branches to prefecture branches. The headquarter network is a first-class node, the provincial branch network form a second-class node, and the prefecture branch or the sub-branch network is a third-class node.
Sales servers, business servers, and intermediary business servers are aggregated to the core switch. Core switches usually have redundant backup. The core switch connects sales servers, business servers with prefecture branch network centers and the sub-branch network centers. The servers are also connected to telecom operators, China Mobile, and stock exchanges. These servers provide business services to bank outlets.
For backbone and business network, Hillstone series security appliance provides high-integrated and easily extensible solutions:
- Up to 480G backplane bandwidth to carry the original load of the aggregation layer switch
- Up to 44 ports convenient for exchange and policy control
- Bandwidth management and session control based on IP address
- Authentication based on Web redirection and L2TP
- Session control and session rampup per second to protect back-end server
- Load balance and various security checking technologies
- Support IPSec VPN
- Record and audit of network connection log
- Record and statistics of traffic log
Security Protection for Online Bank
Online banking is attracting increasing number of customers because its rich features, simple procedure, flexible configuration and convenient. However, online banking also could easily be targeted by unlawful intrusion and malicious attacks because of vulnerabilities in the protection system and the weak security awareness. Hacker or attacker may hide many miles away and evading the justice system. The numerous financial transaction data in the open network not only involves great economic benefits, but also contains substantial user privacy, which will attract intrusion, monitoring, spoofing, and attack from network lawbreakers.
Hillstone security appliance provides highly integrated and easily expended solutions for online banking.
- DoS/DDoS and SYN protection
- Up to 480G backplane bandwidth to carry the original load of the aggregation layer switch
- Up to 44 ports convenient for exchange and policy control
- Bandwidth management and session control based on IP address
- Authentication based on Web redirection and L2TP
- Session control and session rampup to protect back-end server
- Load balance and various security checking technologies
- High-performance virus detection and filtering
- Record and audit of network connection log
- Record and statistics of traffic log
Extend SSL VPN Solution for Financial Network
The third-generation SSL VPN technology – Hillstone security connection VPN provides secure, reliable, encrypted, integrated, and non-repudiated communication mechanism:
- Login authentication based on HTTPS, high-strength encryption and fast data transfer equivalent that of IPSec VPN.
- Provide USB-Key authentication and can combine with the third-party authentication
- Support hardware binding for connected users and PCs
- Support security scanning of user PC to determine user level of access
Unified Log Audit as well as Device Management and Monitor
After deployment of the high-performance security appliance, administrator faces the problem of managing the device: monitoring the device, collecting network usage log, collecting network operation status, and recording user behavior.
Hillstone Security Management (HSM), Hillstone’s centralized management system, provides:
- Record attack log and statistics
- Record traffic log and statistics
- Record network behavior: such as webpage browsing, content of BBS posting, content and attachment of outgoing emails, record of access based on port IP, etc.
- Record log and statistics of virus detected by anti-virus function
- Record log and statistics of attacks detected by IPS mechanism
- Record statistics of top N users who occupy the most upstream and downstream bandwidth and session
- Record statistics of device operation status
|
|
|
|
