Cisco IT recently completed a TrustSec project to assist in the divestiture of CPE business to Technicolor which was announced in July, 2015.
When Cisco sold a portion of its video business to Technicolor in November 2015, some of the transferred employees still needed access to certain resources on the Cisco network. These employees would be working in Cisco offices—located in Shanghai, China, and Lawrenceville, Georgia—until they transferred to Technicolor offices or the offices were turned over to Technicolor. In the meantime, we needed a secure, economical way to give these employees defined access to the Cisco network and its resources from the Cisco offices.
We wanted to provide this segmented access through a logical separation in the network infrastructure, instead of the costly and cumbersome effort to add dedicated circuits to our nearest network hubs. We also wanted to make sure these users would not be able to get full network access simply by plugging into a wired port in a Cisco office.
To meet these requirements, we developed a new solution called dynamic user policy. The policy uses access control capabilities in the Cisco® Identity Services Engine (ISE) and the security group tagging feature in Cisco TrustSec® technology.
With dynamic user policy, we configure policies on the Cisco ISE to define which Technicolor users are authorized and which applications (e.g., email) and resources (e.g. Cisco WebEx®) they can access on the Cisco network. By basing access permissions on username, the dynamic user policy approach provides granular security that follows the user, enforcing the same policies regardless of where the user connects to the Cisco network.
The paper is available at:
http://www.cisco.com/c/en/us/solutions/collateral/enterprise/cisco-on-cisco/i-en-02292016-Policies-to-Control-User-Acces…
